Critical HashiCorp Vault Vulnerabilities Allow Authentication Bypass and DoS Attacks

HashiCorp has disclosed two critical vulnerabilities in Vault and Vault Enterprise that could enable authentication bypass and denial-of-service attacks against infrastructure. According to HashiCorp, the first issue, Bulletin HCSEC-2025-31, stems from a regression in how Vault processes JSON payloads and CVE-2025-12044; unauthenticated attackers can trigger DoS by submitting specially crafted JSON requests because rate limiting is applied after payload processing.

The second flaw, CVE-2025-11621 under HCSEC-2025-30, enables authentication bypass in Vault’s AWS authentication method and affects Vault Community Edition 0.6.0 through 1.20.4 and corresponding enterprise versions, with a related EC2 auth method issue. Affected versions span Vault Community Edition 1.20.3 to 1.20.4 and multiple enterprise releases, with remediation guidance recommending upgrades to Vault Community Edition 1.21.0 or Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27.

The vulnerabilities were discovered by Toni Tauro of Adfinis AG and Pavlos Karakalidis, and HashiCorp notes these flaws pose substantial risk to organisations relying on Vault for secrets management. Public disclosure came from a HashiCorp publication dated 23 October 2025.