7.4
Élevée
CVE-2025-13357 Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by…
Description
Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Tooling 4.2 | 4.2.0 → < 5.5.0 | 5.5.0 |
Autres CVE de Tooling
Les 13 CVE de Tooling →
CVE-2026-110720
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding…
9.9
Critique
CVE-2026-87993
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow…
7.7
Élevée
CVE-2026-8715
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in…
9.6
Critique
CVE-2026-16326
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may…
10.0
Critique