CVE-2025-54997
In versions 2.3.1 and below, some OpenBao deployments intentionally limit privileged API operators from executing system code or making network connections.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, some OpenBao deployments intentionally limit privileged API operators from executing system code or making network connections. However, these operators can bypass both restrictions through the audit subsystem by manipulating log prefixes. This allows unauthorized code execution and network access that violates the intended security model. This issue is fixed in version 2.3.2. To workaround, users can block access to sys/audit/* endpoints using explicit deny policies, but root operators cannot be restricted this way.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.37% probability · 31th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- openbao/openbao
- Source
- security-advisories@github.com
References
- https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033Not Applicable
- https://github.com/openbao/openbao/pull/1634Issue Tracking
- https://github.com/openbao/openbao/releases/tag/v2.3.2Release Notes
- https://github.com/openbao/openbao/security/advisories/GHSA-xp75-r577-cvhpVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.