The Vault Terraform Provider was found to incorrectly default the deny_null_bind setting for LDAP authentication to false, enabling LDAP servers that allow anonymous or unauthenticated binds to be used for authentication. This flaw allows attackers who can influence Terraform configuration to obtain authenticated access that was not intended, compromising confidentiality and integrity of the Vault secrets stored by the provider.

The vulnerability affects the HashiCorp Vault Terraform Provider before version 5.5.0. Any deployments using Terraform to provision Vault resources with the LDAP auth method and relying on the default deny_null_bind setting are potentially impacted. The issue was addressed in release 5.5.0 of the provider.

The flaw carries a CVSS metric of 7.4, indicating a high severity. The EPSS score is below one percent, suggesting exploitation is currently unlikely but still possible in a determined threat scenario. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have influence over Terraform configurations and the target environment must use an LDAP server that permits anonymous or unauthenticated binds. When both conditions are present, the attacker can bypass authentication controls and gain privileged access.