PT-2025-26866 · Openbao · Openbao

Cipherboy · Published 2025-06-25 · Updated 2025-07-28 · CVE-2025-52894

Positive Technologies · (AI Summary)

CVSS v4.0

6.9

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions:

OpenBao versions prior to 2.3.0

Description:

OpenBao is a software solution for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. The issue allows an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, resulting in a denial of service.

Recommendations:

For OpenBao versions prior to 2.3.0, manually set the configuration option `disable unauthed rekey endpoints=true` to deny these endpoints on global listeners.

As a temporary workaround, if an active proxy or load balancer sits in front of OpenBao, consider denying requests to these endpoints from unauthorized IP ranges.

Update to version 2.3.0 or later, where the issue is resolved.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-20

CWE-306

Related Identifiers

CVE-2025-52894

GHSA-PRPJ-RCHP-9J5H

GO-2025-3783

Affected Products

Openbao

References · 11

• https://osv.dev/vulnerability/GHSA-prpj-rchp-9j5h · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3783 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52894 · Security Note
• https://github.com/openbao/openbao · Note
• https://github.com/openbao/openbao/commit/fe75468822a22a88318c6079425357a02ae5b77b · Note
• https://github.com/openbao/openbao/releases/tag/v2.3.1 · Note
• https://github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h · Note
• https://twitter.com/CVEnew/status/1937922803384131929 · Twitter Post
• https://openbao.org/docs/deprecation · Note
• https://openbao.org/docs/deprecation/unauthed-rekey · Note