What is CVE-2025-13357?

CVE-2025-13357 is a high-severity vulnerability in Hashicorp Terraform Provider, classified under Initialization of a Resource with an Insecure Default. CVSS score: 7.4/10. Published 2025-11-21.

How severe is CVE-2025-13357?

High severity. CVSS v3 base score is 7.4 out of 10.

RCE in Hashicorp Terraform Provider

CVE-2025-13357

Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.

EPSS: 0.005 (43.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Hashicorp Terraform_provider
Hashicorp Tooling — versions 4.2.0

Weakness classification (CWE)

CWE-1188 — Initialization of a Resource with an Insecure Default

References

security@hashicorp.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-13357?: CVE-2025-13357 is a high-severity vulnerability in Hashicorp Terraform Provider, classified under Initialization of a Resource with an Insecure Default. CVSS score: 7.4/10. Published 2025-11-21.
How severe is CVE-2025-13357?: High severity. CVSS v3 base score is 7.4 out of 10.