CVE-2025-13357

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-13357
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13357.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-13357
Aliases
Downstream
Related
Published
2025-11-21T15:02:27Z
Modified
2026-08-12T03:51:09Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
Details

Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.

Database specific 
{
    "cna_assigner": "HashiCorp",
    "cwe_ids": [
        "CWE-1188"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13357.json"
}
References

Affected packages

Git / github.com/hashicorp/terraform-provider-vault

Affected ranges

Type
GIT
Repo
https://github.com/hashicorp/terraform-provider-vault
Events
Introduced
2822bae19ce749d531e619971343ffb43e944051
Fixed
148e86b0882c1415282a8236dc1e48cea20c70cb
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:hashicorp:terraform_provider:*:*:*:*:*:vault:*:*",
    "extracted_events": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "5.5.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v4.*
v4.2.0
v4.3.0
v4.4.0
v4.5.0
v4.6.0
v4.7.0
v4.8.0
v5.*
v5.0.0
v5.1.0
v5.2.0
v5.2.1
v5.3.0
v5.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13357.json"