---
id: CVE-2025-4166
aliases:
  - GHSA-gcqf-f89c-68hv
  - BIT-openbao-2025-4166
  - BIT-vault-2025-4166
  - GO-2025-3663
title: >-
  Hashicorp Vault Community vulnerable to Generation of Error Message Containing
  Sensitive Information
summary: >-
  Hashicorp Vault Community vulnerable to Generation of Error Message Containing
  Sensitive Information
severity: medium
cvss: 4.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N'
vendor: hashicorp
product: github.com/hashicorp/vault
ecosystem: go
affected:
  - 'github.com/hashicorp/vault >= 0.3.0, < 1.19.3'
patched:
  - github.com/hashicorp/vault 1.19.3
published: '2025-05-02'
updated: '2026-07-27'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-gcqf-f89c-68hv'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-4166'
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin
  - url: 'https://github.com/hashicorp/vault'
  - url: 'https://pkg.go.dev/vuln/GO-2025-3663'
tags:
  - osv
  - go
epss: 0.00431
epssPercentile: 0.36734
ingestedAt: '2026-07-27T19:08:54.751Z'
---

## Overview

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

## Affected packages

- `github.com/hashicorp/vault >= 0.3.0, < 1.19.3`

## Remediation

Upgrade to a patched release:

- `github.com/hashicorp/vault 1.19.3`