CVE-2025-13357

🗓️ 21 Nov 2025 15:02:27Reported by HashiCorpType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 19 Views

Vault Terraform Provider defaulted LDAP deny_null_bind to false, risking auth bypass; fixed in 5.5.0.

Reporter	Title	Published	Views	Family All 19
IBM Security Bulletins	Security Bulletin: Vault Terraform Provider Incorrect Defaults for LDAP Auth Method, Resulting in Insecure Configuration and Potential Authentication Bypass	21 May 202619:39	–	ibm
Circl	CVE-2025-13357	21 Nov 202515:49	–	circl
CNNVD	HashiCorp Vault Terraform Provider 安全漏洞	21 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-13357 Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method	21 Nov 202515:02	–	cvelist
EUVD	EUVD-2025-198491	21 Nov 202515:31	–	euvd
Github Security Blog	Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default	21 Nov 202515:31	–	github
NVD	CVE-2025-13357	21 Nov 202515:15	–	nvd
OSV	GHSA-GMM6-J2G5-R52M Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default	21 Nov 202515:31	–	osv
OSV	GO-2025-4152 Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default in github.com/hashicorp/terraform-provider-vault	25 Nov 202518:12	–	osv
OSV	SUSE-SU-2025:4395-1 Security update for govulncheck-vulndb	15 Dec 202511:15	–	osv

NVD

Node

hashicorp terraform_providerRange4.2.0–5.5.0vault

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "product": "Tooling",
    "repo": "https://github.com/hashicorp/terraform-provider-vault",
    "vendor": "HashiCorp",
    "versions": [
      {
        "lessThan": "5.5.0",
        "status": "affected",
        "version": "4.2.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
discuss	www.discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822

17 Apr 2026 17:57Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.4 - 9.8

EPSS0.00018

SSVC

CWE-1188