What is CVE-2025-4166?

CVE-2025-4166 is a medium-severity vulnerability in Hashicorp Vault, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 4.5/10. Published 2025-05-02.

How severe is CVE-2025-4166?

Medium severity. CVSS v3 base score is 4.5 out of 10.

Information disclosure in Hashicorp Vault

CVE-2025-4166

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

EPSS: 0.004 (28.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N.

Affected products

Hashicorp Vault — versions 0.3.0
Hashicorp Vault Enterprise — versions 0.10.0
Openbao

Weakness classification (CWE)

CWE-209 — Generation of Error Message Containing Sensitive Information

References

security@hashicorp.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-4166?: CVE-2025-4166 is a medium-severity vulnerability in Hashicorp Vault, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 4.5/10. Published 2025-05-02.
How severe is CVE-2025-4166?: Medium severity. CVSS v3 base score is 4.5 out of 10.