UpHeron
All vulnerabilities

Servers and applications

CVE-2025-54996

OpenBao Operator May Elevate Token Privileges

Severity
High 7.2
Published
8 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.3.2
Also known as
GHSA-vf84-mxrq-crqc
Sources
NVD, Project advisories (GitHub)

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, accounts with access to highly-privileged identity entity systems in root namespaces were able to increase their scope directly to the root policy. While the identity system allowed adding arbitrary policies, which in turn could…

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cpe:a:openbao:openbao
  • Every version before 2.3.2
OpenBaoServers and applications · github:openbao/openbao
  • Every version before 2.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-54996
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-54996
  • GitHub Advisory Database https://github.com/advisories/GHSA-vf84-mxrq-crqc
  • github.com https://github.com/openbao/openbao/security/advisories/GHSA-vf84-mxrq-crqc