# When is the next release for github.com/vault/api?

**URL:** <https://discuss.hashicorp.com/t/when-is-the-next-release-for-github-com-vault-api/76116>\
**Category:** Vault\
**Created:** [August 7, 2025, 10:00am UTC](https://discuss.hashicorp.com/t/when-is-the-next-release-for-github-com-vault-api/76116 "2025-08-07T10:00:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tommyd450](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tommyd450/32/46234_2.png) [@tommyd450](https://discuss.hashicorp.com/u/tommyd450)\
**Post date:** [August 7, 2025, 10:00am UTC](https://discuss.hashicorp.com/t/when-is-the-next-release-for-github-com-vault-api/76116/1 "2025-08-07T10:00:08Z")

</div>

Mainly curious over these cve’s and if they affect vault/api? And when to expect a release for resolving them within vault api. Thanks in advance!

> [@HCSEC-2025-14 - Privileged Vault Operator May Execute Code on the Underlying Host](https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033):
>
> Bulletin ID: HCSEC-2025-14 Affected Products / Versions: Vault Community Edition from 0.8.0 up to 1.20.0, fixed in 1.20.1. Vault Enterprise from 0.8.0 up to 1.20.0, 1.19.6, 1.18.11, 1.16.22, 1.15.15, fixed in 1.20.1, 1.19.7, 1.18.12, and 1.16.23. Publication Date: August 1, 2025 Summary A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. This vulnerabi…

> [@HCSEC-2025-13 - Vault Root Namespace Operator May Elevate Token Privileges](https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032):
>
> Bulletin ID: HCSEC-2025-13 Affected Products / Versions: Vault Community Edition from 0.10.4 up to 1.19.5, fixed in 1.20.0. Vault Enterprise from 0.10.4 up to 1.19.5, 1.18.11, 1.16.21, fixed in 1.20.0, 1.19.6, 1.18.11 and 1.16.22. Publication Date: August 1, 2025 Summary A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. This vulnerability, identified as CVE-2025-599…

---

<div class="post-metadata">

**Author:** ![mickael](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mickael/32/20186_2.png) [@mickael](https://discuss.hashicorp.com/u/mickael)\
**Post date:** [August 7, 2025, 3:54pm UTC](https://discuss.hashicorp.com/t/when-is-the-next-release-for-github-com-vault-api/76116/2 "2025-08-07T15:54:58Z")

</div>

These issues do not affect the Vault API or client, they only affect a Vault server.