Vault Fault bugs in CyberArk and HashiCorp could let hackers take over secret stores without credentials

The vulnerabilities can be combined into sophisticated attack chains, researchers say

A cybersecurity firm has revealed a set of over a dozen vulnerabilities, dubbed "Vault Fault," in enterprise secure vaults from CyberArk and HashiCorp.

These flaws could allow remote attackers to take over corporate identity systems and extract sensitive enterprise secrets and tokens without needing any credentials.

The flaws, discovered and responsibly disclosed by the identity security firm Cyata, affect CyberArk Secrets Manager, Self-Hosted and Conjur Open Source, as well as HashiCorp Vault.

Both of these products are widely used in DevOps environments and are designed to not only store secrets but also enforce policies for their access and use.

The vulnerabilities, totalling 14, were found in the products' authentication, validation and policy enforcement mechanisms. They enabled attackers to bypass lockout protections, evade policy checks and impersonate accounts.

The most critical issues could lead to unauthenticated remote code execution (RCE), allowing an attacker to take over the vault completely under certain conditions.

The most severe flaws

Among the most serious vulnerabilities are several with high CVSS scores:

  1. CVE-2025-49827 (CVSS 9.1): An authentication bypass in the CyberArk Secrets Manager's IAM authenticator
  2. CVE-2025-49831 (CVSS 9.1): Another IAM authenticator bypass in CyberArk Secrets Manager, exploitable via a misconfigured network device
  3. CVE-2025-49828 (CVSS 8.6): A remote code execution flaw in CyberArk Secrets Manager
  4. CVE-2025-6000 (CVSS 9.1): An arbitrary RCE vulnerability in HashiCorp Vault, stemming from plugin catalogue abuse. This particular flaw has been present for over nine years.
  5. CVE-2025-5999 (CVSS 7.2): A privilege escalation bug in HashiCorp Vault that can give an attacker root-level access

In addition to these, other weaknesses were found in HashiCorp Vault's lockout protection logic, which could allow attackers to infer valid usernames through a timing-based side channel and reset lockout counters by simply changing the case of a username (e.g., "admin" to "Admin").

According to Cyata, these vulnerabilities can be combined into sophisticated attack chains.

For instance, in HashiCorp Vault, a threat actor could leverage a certificate impersonation flaw (CVE-2025-6037, which has existed for over eight years) alongside CVE-2025-5999 and CVE-2025-6000 to bypass authentication, escalate privileges and execute arbitrary code.

Once inside, an attacker could even delete the "core/hsm/_barrier-unseal-keys" file, effectively turning the security feature into a ransomware vector.

The vulnerabilities also allowed for the creation of a stealthy, unaudited communication channel using the Control Group feature.

For CyberArk products, an attack sequence was detailed that moves from unauthenticated access to full RCE without ever providing a password, token, or AWS credentials.

This chain involves forging AWS "GetCallerIdentity" responses to bypass IAM authentication, impersonating a policy resource, and then using a malicious payload with an Embedded Ruby (ERB) template to trigger code execution.

Both CyberArk and HashiCorp were notified in May 2025 and have since released patches to address these vulnerabilities.

The affected versions and their patched counterparts are:

  1. CyberArk Secrets Manager and Self-Hosted: Affected versions are patched in 13.5.1 and 13.6.1.
  2. CyberArk Conjur Open Source: Patched in version 1.22.1.
  3. HashiCorp Vault Community and Enterprise: Patched in versions 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

Organisations using these products are strongly advised to update their systems immediately to the patched versions to mitigate the risk of a potential breach.