# CVE-2025-13357: Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method

> CVE-2025-13357: Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method. CVSS 7.4 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-13357
Last updated: 2026-10-08T10:10:00Z

- Published: 2025-11-21 15:02 UTC · Updated: 2026-10-08 10:10 UTC · Assigner: HashiCorp
- CVSS: 7.4 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS: 0.53%, 45th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-1188

## Description

Vault’s Terraform Provider incorrectly set the default deny\_null\_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.

## Affected vendors and products

- HashiCorp: Tooling

## Tracked companies

- [HashiCorp](https://rewindex.com/company/hashicorp.md)
- [Terraform Cloud (HCP)](https://rewindex.com/company/terraform-cloud-hcp.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-13357)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-13357)
- [https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822](https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-13357 · Markdown: https://rewindex.com/cve/CVE-2025-13357.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-13357 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:04:39.051Z