{"action":"Upgrade github.com/hashicorp/terraform-provider-vault to 5.5.0 or later.","affected":[{"fixed":"5.5.0","introduced":"0"}],"component":"github.com/hashicorp/terraform-provider-vault","cve_ids":["CVE-2025-13357"],"ecosystem":"Go","epss":0.00532,"exploited":false,"fixed_versions":["5.5.0"],"ghsa_id":"GHSA-gmm6-j2g5-r52m","id":"tcs_01M5KFB5EMM9VZVDE3YYEH8MWH","modified_at":"2025-11-27T08:55:47.441136Z","published_at":"2025-11-21T15:31:28Z","references":["https://osv.dev/vulnerability/GHSA-gmm6-j2g5-r52m","https://nvd.nist.gov/vuln/detail/CVE-2025-13357","https://github.com/hashicorp/terraform-provider-vault/pull/2622","https://github.com/hashicorp/terraform-provider-vault/commit/882bc7f409acc99c872c345edd65159d9568589a","https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822","https://github.com/advisories/GHSA-gmm6-j2g5-r52m","https://github.com/hashicorp/terraform-provider-vault","https://github.com/hashicorp/terraform-provider-vault/releases/tag/v5.5.0"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-gmm6-j2g5-r52m","url":"https://osv.dev/vulnerability/GHSA-gmm6-j2g5-r52m"}],"summary":"Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default"}