7.4
High
CVE-2025-13357 Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by…
Description
Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Tooling 4.2 | 4.2.0 → < 5.5.0 | 5.5.0 |
Other CVEs of Tooling
The 13 CVEs of Tooling →
CVE-2026-110720
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding…
9.9
Critical
CVE-2026-87993
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow…
7.7
High
CVE-2026-8715
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in…
9.6
Critical
CVE-2026-16326
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may…
10.0
Critical