Bump hashicorp/vault/api to v1.16.27+ to fix CVE-2025-11621, CVE-2025-12044
Open
Nobody has claimed this yet.
kind/bug
- Dominant language
- Go
- Stars
- 461
- Forks
- 277
- Avg merge
- 16h 48m
- Merged PRs (30d)
- 95
Description
Summary
Two Vault CVEs affect tkn:
- CVE-2025-11621: AWS auth method bypass via cache mishandling (CVSS 8.1)
- CVE-2025-12044: DoS via rate limit regression (CVSS 7.5)
Current State
- main: v1.16.0
- release-v0.42.0: v1.16.0
- release-v0.37.2: v1.12.2
Required
Bump github.com/hashicorp/vault/api to v1.16.27+.
References
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the dependency declaration for github.com/hashicorp/vault/api and inspect how the current v1.16.0 version is recorded. Update it to v1.16.27 or newer, refresh the related dependency metadata, and run the repository's standard Go checks to confirm the CLI still builds and tests pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100