UpHeron
All vulnerabilities

Servers and applications

CVE-2025-52894

Unauthenticated Rekey Operation Cancellation

Severity
Medium 6.9
Published
25 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.3.0
Also known as
GHSA-prpj-rchp-9j5h
Sources
NVD, Project advisories (GitHub)

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option…

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cpe:a:openbao:openbao
  • From 2.2.0 before 2.3.0
OpenBaoServers and applications · github:openbao/openbao
  • Every version before 2.3.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-52894
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-52894
  • GitHub Advisory Database https://github.com/advisories/GHSA-prpj-rchp-9j5h
  • github.com https://github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h