Vulnerability · Published Jun 25, 2025 · Assigned by GitHub_M

CVE-2025-52894OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation

Medium 6.9

In plain English

A medium-severity improper input validation in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 66.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao release communicated on OpenBao's website, the maintainers will set this to `true` for all users and provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.22	openbao	2.3.1-r0	ALPINE-CVE-2025-52894
Alpine:v3.23	openbao	2.3.1-r0	ALPINE-CVE-2025-52894
Alpine:v3.24	openbao	2.3.1-r0	ALPINE-CVE-2025-52894
Go	github.com/openbao/openbao	no fix listed	GHSA-prpj-rchp-9j5h
Go	github.com/openbao/openbao	0.0.0-20250625150133-fe75468822a2	GHSA-prpj-rchp-9j5h
Go	github.com/openbao/openbao	no fix listed	GO-2025-3783

Affected products (as reported)

Vendor	Product	Versions
openbao	openbao	< 2.3.0

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h x_refsource_CONFIRM
https://github.com/openbao/openbao/commit/fe75468822a22a88318c6079425357a02ae5b77b x_refsource_MISC
https://openbao.org/docs/deprecation x_refsource_MISC
https://openbao.org/docs/deprecation/unauthed-rekey x_refsource_MISC