{"cve":"CVE-2025-4166","nvd":{"published":"2025-05-02T15:15:50.313","modified":"2026-06-17T09:32:41.227","status":"Analyzed","description":"Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-209"],"references":["https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin"],"products":["hashicorp:vault","openbao:openbao"],"source":"nvd","synced_at":"2026-10-19T22:01:22.920403922+00:00"},"epss":{"cve":"CVE-2025-4166","score":0.00449,"percentile":0.39059,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-gcqf-f89c-68hv","url":"https://osv.dev/vulnerability/GHSA-gcqf-f89c-68hv","summary":"Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information","modified":"2026-09-10T03:50:57.562022580Z","packages":[{"ecosystem":"Go","name":"github.com/hashicorp/vault","purl":"pkg:golang/github.com/hashicorp/vault","ranges":[">=0.3.0 <1.19.3"],"fixed":["1.19.3"]}]},{"id":"GO-2025-3663","url":"https://osv.dev/vulnerability/GO-2025-3663","summary":"Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault","modified":"2026-07-27T09:11:29.300565599Z","packages":[{"ecosystem":"Go","name":"github.com/hashicorp/vault","purl":"pkg:golang/github.com/hashicorp/vault","ranges":[">=0.3.0 <1.19.3"],"fixed":["1.19.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}