Overview
A critical security vulnerability, identified as CVE-2025-64761, has been discovered in OpenBao, an open-source identity-based secrets management system. This vulnerability allows a privileged operator to escalate their own or another user’s permissions to root-equivalent within the system. This issue affects versions prior to 2.4.4. Immediate action is required to mitigate the risk.
Technical Details
The vulnerability resides within the identity group subsystem of OpenBao. Specifically, it can be exploited under the following conditions:
- An operator in the root namespace has access to the
identity/groupsendpoints. - The operator does not have policy access.
In this scenario, the operator could add a root policy to a group identity group, thereby escalating the privileges of users belonging to that group. Alternatively, an operator *with* policy access could create or modify existing policies to grant root-equivalent permissions through the sudo capability.
This vulnerability allows for unauthorized access to sensitive data and control over the OpenBao system.
CVSS Analysis
Due to the potential for complete system compromise, this vulnerability is considered high risk. However, the exact CVSS score is not yet available (N/A). Once the official CVSS score is released, this section will be updated.
Severity: N/A
CVSS Score: N/A
Possible Impact
Successful exploitation of this vulnerability could lead to severe consequences, including:
- Unauthorized access to all secrets stored within OpenBao.
- Complete compromise of the OpenBao system.
- Data breaches and leakage of sensitive information.
- Denial of service by malicious actors.
Mitigation or Patch Steps
The recommended solution is to upgrade to OpenBao version 2.4.4 or later. This version contains the necessary patch to address the vulnerability.
If upgrading is not immediately feasible, consider the following temporary mitigations:
- Restrict access to the
identity/groupsendpoints to only the necessary personnel. - Carefully review and restrict policy access to prevent the creation or modification of policies granting root-equivalent permissions, especially the use of the
sudocapability. - Monitor OpenBao logs for suspicious activity related to identity group management and policy changes.
