When is the next release for github.com/vault/api?

[tommyd450]

Mainly curious over these cve’s and if they affect vault/api? And when to expect a release for resolving them within vault api. Thanks in advance!

HCSEC-2025-14 - Privileged Vault Operator May Execute Code on the Underlying Host

Bulletin ID: HCSEC-2025-14 Affected Products / Versions: Vault Community Edition from 0.8.0 up to 1.20.0, fixed in 1.20.1. Vault Enterprise from 0.8.0 up to 1.20.0, 1.19.6, 1.18.11, 1.16.22, 1.15.15, fixed in 1.20.1, 1.19.7, 1.18.12, and 1.16.23. Publication Date: August 1, 2025 Summary A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. This vulnerabi…

HCSEC-2025-13 - Vault Root Namespace Operator May Elevate Token Privileges

Bulletin ID: HCSEC-2025-13 Affected Products / Versions: Vault Community Edition from 0.10.4 up to 1.19.5, fixed in 1.20.0. Vault Enterprise from 0.10.4 up to 1.19.5, 1.18.11, 1.16.21, fixed in 1.20.0, 1.19.6, 1.18.11 and 1.16.22. Publication Date: August 1, 2025 Summary A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. This vulnerability, identified as CVE-2025-599…

[mickael]

These issues do not affect the Vault API or client, they only affect a Vault server.