HashiCorp Vault Flaws Explained: AWS Auth Bypass & JSON DoS Deep Dive

By CyberDudeBivash — 27 October 2025

TL;DR — Quick facts

AWS Auth bypass (CVE-2025-11621): a cache/matching bug in Vault’s AWS auth method can allow authentication bypass when bound_principal_iam uses the same role name across AWS accounts or a wildcard — patched in Vault 1.21.0 and backported vendor releases. NVD+1
Unauthenticated JSON DoS (CVE-2025-12044): a regression in JSON handling / rate-limit logic allows complex JSON payloads to be processed before rate-limits apply, enabling unauthenticated attackers to force high CPU/memory parsing and cause denial of service — patched in the same Vault releases. HashiCorp Discuss+1
Action: Inventory Vault instances (including Enterprise), identify AWS auth uses and public/untrusted endpoints, and upgrade to Vault 1.21.0 / vendor patched builds immediately. HashiCorp Discuss+1

Background & timeline

HashiCorp published security advisories and discussed both issues in their HCSEC posts in late October 2025; CVE assignments and third-party writeups followed immediately. These are not low-risk bookkeeping bugs — they affect authentication correctness and unauthenticated parsing paths — so treat them as high priority. HashiCorp Discuss+1

Vulnerability #1 — AWS Auth Method: cache / bound_principal_iam mishandling (CVE-2025-11621)

What is the problem?

Vault’s AWS Auth method validates AWS principals (instances / roles) against configured bindings such as bound_principal_iam. A bug in how Vault caches and compares AWS client identity entries can result in a principal being considered a match even when it belongs to a different AWS account — especially when the same IAM role name exists in multiple accounts or when a wildcard is used. This can let an attacker present valid-looking AWS metadata and bypass the intended cross-account checks, resulting in authentication bypass. NVD+1

Why it’s serious

This is an authentication bypass — the attacker can obtain Vault tokens or role-bound credentials without having the intended IAM identity. For teams using Vault to broker secrets into multi-account AWS environments, this undermines trust boundaries and can allow secrets exfiltration or lateral movement. zeropath.com

Affected versions & patch

Fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, plus backports (1.20.5, 1.19.11, 1.16.27). If you use vendor images that bundle Vault, expect vendor advisories and firmware updates as well. NVD+1

Exploitability

Exploitability is high in setups where:

Administrators used the same IAM role name across different AWS accounts, or
bound_principal_iam was configured with broad/wildcard values, or
Vault endpoints are reachable to untrusted clients that can call the AWS auth flow (e.g., metadata-forwarding proxies, compromised worker nodes).
If these conditions exist, an attacker can authenticate and obtain tokens. radar.offseq.com

Vulnerability #2 — Unauthenticated JSON DoS (CVE-2025-12044) — rate-limit regression

What is the problem?

A regression introduced while hardening prior JSON parsing DoS paths caused Vault to begin processing complex JSON payloads before applying rate-limit and complexity checks. Because certain crafted JSON payloads (deeply nested or pathological structures) can force excessive CPU and memory consumption during parsing, an attacker can submit such payloads to unauthenticated endpoints and cause Vault to become unresponsive or crash — i.e., unauthenticated denial of service. HashiCorp Discuss+1

Why it’s serious

The vulnerability is unauthenticated — no credentials are required to submit the payloads in many default configurations.
Previous protections (rate-limits / complexity checks) were bypassed by ordering/regression in request handling, so systems thought to be hardened became vulnerable again. miggo.io+1

Affected versions & patch

HashiCorp lists the regression and CVE; patches are included in Vault 1.21.0 and the same backported Enterprise releases. Apply those releases or vendor patches. HashiCorp Discuss+1

Detection — what to look for now

Authentication anomalies: unexpected tokens obtained via AWS auth flows, suspicious token issuances for principals that shouldn’t match. Correlate Vault auth logs with AWS CloudTrail to verify origin accounts. zeropath.com
High CPU / memory spikes on Vault servers tied to parsing requests; unusual request patterns containing giant or deeply nested JSON payloads. Monitor ingress request sizes vs CPU/parse time. miggo.io
Log signals: authentication log entries with unexpected principal/account combinations; JSON parsing errors, or spike in 5xx responses and restart events. Use audit and telemetry backends to collect these traces. HashiCorp Discuss+1

Immediate mitigation & remediation (action checklist)

Upgrade Vault immediately to 1.21.0 (Community) or the listed Enterprise patches (1.21.0 / 1.20.5 / 1.19.11 / 1.16.27) — vendor-backported releases included. This addresses both CVE-2025-11621 and CVE-2025-12044. Test upgrades in staging before production rollout. NVD+1
Harden AWS Auth configs now:
- Avoid wildcards in bound_principal_iam. Use explicit ARNs with account IDs whenever possible.
- Do not rely on role names alone if those names are re-used across accounts — prefer full ARNs and limit cross-account trust to minimal required principals. HashiCorp Discuss
Limit Vault exposure: Ensure Vault API endpoints are not exposed to public networks; place Vault behind authenticated gateways, API proxies, or network ACLs. This reduces the attack surface for unauthenticated JSON DoS. HashiCorp Discuss
Rate-limit at the edge: Implement WAF / API gateway rate limiting and JSON size/complexity checks in front of Vault (NGINX, Envoy, Cloud API GW rules) so pathological payloads are blocked before reaching Vault. Do not rely solely on in-process checks while you patch. zeropath.com
Audit & rotate tokens: If you suspect auth bypass occurred, rotate affected role tokens, revoke long-lived tokens, and perform a secrets audit to identify any suspicious reads. Use Vault’s revocation and audit tools to invalidate compromised leases/tokens. zeropath.com
Monitor & alert: Add telemetry alerts for sudden token creation rates, unusual source accounts, spikes in parsing CPU time, and increase logging verbosity temporarily if investigating suspected exploitation. miggo.io

For vendors / platform teams

Ensure vendor appliance images incorporating Vault are updated and pushed ASAP. Communicate urgent patch guidance to customers and provide a simple rollback/restore plan. GitHub
MSSPs and cloud platform teams should scan for Vault instances (including sidecars and developer instances) and treat them as critical — many developer/test clusters are left with weak network controls. HashiCorp Discuss

Example quick remediation commands

(Modify to match your deployment — Docker/k8s/systemd examples)

Kubernetes (if using HashiCorp Helm chart): bump image tag to hashicorp/vault:1.21.0 in your Helm values, run helm upgrade, then validate pods and readiness/liveness.
Deb/RPM / Binary installs: replace binaries and restart:systemctl stop vault # backup config + data apt-get install vault=1.21.0 # example - follow vendor packaging systemctl start vault journalctl -u vault -f
Rotate tokens / revoke leases: use vault token revoke <token> or vault lease revoke -prefix=<prefix> as appropriate.

Always run these in staging and confirm telemetry/alerts clear before mass rollout.

References (authoritative & reading)

HashiCorp security discussion / advisories (HCSEC posts for both issues). HashiCorp Discuss+1
NVD / CVE record for CVE-2025-11621 (AWS auth bypass). NVD
Community analysis / writeups on JSON DoS regression (CVE-2025-12044) and technical breakdowns. zeropath.com+1
GHSA / OSV advisories listing affected versions and fix info. osv.dev

Suggested

Urgent — HashiCorp Vault patches for an AWS Auth bypass (CVE-2025-11621) and an unauthenticated JSON DoS (CVE-2025-12044). If you run Vault (Community or Enterprise), inventory your AWS auth configs and upgrade to 1.21.0 now. Full technical brief by CyberDudeBivash. #Vault #HashiCorp #CVE #DevSecOps #PatchNow

HashiCorp Vault — patch now: CVE-2025-11621 (AWS auth bypass) & CVE-2025-12044 (unauth JSON DoS). Upgrade → 1.21.0. Read more: [link] #CyberDudeBivash #Vault #PatchNow

Cyberdudebivash