GO-2025-4152

None

CVSS

—

EPSS

—

Published

Nov 25, 2025

CISA due date

—

The record

Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default in github.com/hashicorp/terraform-provider-vault

Affected packages

Ecosystem	Package	Introduced	Fixed
Go	github.com/hashicorp/terraform-provider-vault	0	No fix
Go	github.com/hashicorp/terraform-provider-vault	0	5.5.0

Related vulnerabilities

CVE-2025-13357 Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth… Same vulnerability