CVE-2025-5999 Vault Root Namespace Operator May Elevate Token Privileges
A privileged Vault operator can escalate token privileges to root policy by writing to the root namespace identity endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-5999?
CVE-2025-5999 is a high-severity vulnerability in Hashicorp Vault, published on 1 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.
Weakness: CWE-266
Which versions are affected by CVE-2025-5999?
4 open source packages ship an affected version, including github.com/hashicorp/vault and vault. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/vault Go | From 0.10.4 | 1.20.0 |
github.com/hashicorp/vault Go | From 0.10.4 | 1.20.0 |
github.com/hashicorp/vault Go | From 0.10.4 | 1.20.0 |
vault Bitnami | From 0.10.4 | 1.20.0 |
Products include Hashicorp Vault.
How do I fix CVE-2025-5999?
Upgrade github.com/hashicorp/vault to 1.20.0 or later.
Is CVE-2025-5999 being exploited?
There is no known exploitation of CVE-2025-5999 in the wild and no public exploit code.
Other vulnerabilities in Hashicorp Vault
Sources
Also known as BIT-vault-2025-5999, GHSA-6h4p-m86h-hhgh, GO-2025-3837, MINI-cx9g-34qp-3825.