Log in Start free

Vulnerability · Published Aug 9, 2025 · Assigned by GitHub_M

CVE-2025-54997OpenBao: Privileged Operator May Execute Code on the Underlying Host

Critical 9.1

In plain English

A critical-severity code injection in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.4%top 62.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, some OpenBao deployments intentionally limit privileged API operators from executing system code or making network connections. However, these operators can bypass both restrictions through the audit subsystem by manipulating log prefixes. This allows unauthorized code execution and network access that violates the intended security model. This issue is fixed in version 2.3.2. To workaround, users can block access to sys/audit/* endpoints using explicit deny policies, but root operators cannot be restricted this way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22openbao2.3.2-r0ALPINE-CVE-2025-54997
Alpine:v3.23openbao2.3.2-r0ALPINE-CVE-2025-54997
Alpine:v3.24openbao2.3.2-r0ALPINE-CVE-2025-54997
Gogithub.com/openbao/openbao2.3.2GHSA-xp75-r577-cvhp
Gogithub.com/openbao/openbao0.0.0-20250806194004-a14053c9679dGHSA-xp75-r577-cvhp
Gogithub.com/openbao/openbao0.0.0-20250806194004-a14053c9679dGO-2025-3858

Affected products (as reported)

VendorProductVersions
openbao openbao < 2.3.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References