Bug 2386006 (CVE-2025-5999)

Summary: CVE-2025-5999 github.com/hashicorp/vault: Vault Identity Token Privilege Escalation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bkabrda, caswilli, kaycoth, lball, manissin, ngough, veshanka
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in github.com/hashicorp/vault. This vulnerability allows a privileged Vault operator with write access to the root namespace’s identity endpoint to manipulate token privileges, effectively elevating another user’s token to the Vault root policy. This privilege escalation occurs through crafted writes to the identity endpoint. An attacker can obtain unauthorized root access to the Vault system, allowing complete control over the Vault instance.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-08-01 18:01:28 UTC 
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.