CVE-2025-11621: HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass

The vulnerability lies in the caching mechanism for AWS clients within the AWS authentication backend of HashiCorp Vault. The functions clientEC2 and clientIAM in builtin/credential/aws/client.go were responsible for creating and caching AWS service clients. The cache keys were constructed using only the AWS region and the STS role name. The AWS Account ID was not part of the cache key.

This becomes a security issue when Vault is configured to trust multiple AWS accounts, and these accounts use identical IAM role names. Due to the incomplete cache key, a request for a client for a specific role in one account could mistakenly receive a cached client intended for the same role name but in a different account. This could lead to an authentication bypass, allowing a user to gain unauthorized access to resources.

The patch addresses this by introducing a new clientKey struct that includes the AccountID, Region, and STSRole. The EC2ClientsMap and IAMClientsMap are updated to use this new composite key. This ensures that cached clients are unique per account, region, and role, thereby preventing cache collisions and closing the authentication bypass vulnerability. The identified vulnerable functions, aws.backend.clientEC2 and aws.backend.clientIAM, are the exact locations where the flawed caching logic existed and was subsequently fixed.