High-Severity Vault Flaw (CVE-2025-13357) Allows Unauthenticated Access via LDAP Null Bind Insecure Default

HashiCorp has issued a security advisory regarding a vulnerability (CVE-2025-13357) in the Vault Terraform Provider, which allows unauthenticated access due to a misconfiguration in the LDAP authentication method. The flaw, rated CVSS 7.4, arises from the default setting of the deny_null_bind parameter being set to false, enabling anonymous LDAP binds and authentication without passwords. This issue affects versions v4.2.0 to v5.4.0 of the provider. HashiCorp has released an update (v5.5.0) to correct this default setting, enhancing security against unauthorized access.