CVE-2025-4166CWE-209

Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin

Medium · published May 2, 2025

CVSS v3.1
4.5
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00449 · 38.0th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2025-05-02T14:57Z
EPSS history
Timeline
  • 02 MAY 14:57Z
    Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin
    cvelistv5