UpHeron
All vulnerabilities

Servers and applications

CVE-2025-54997

Privileged OpenBao Operator May Execute Code on the Underlying Host

Severity
Critical 9.1
Published
8 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.3.2
Also known as
GHSA-xp75-r577-cvhp
Sources
NVD, Project advisories (GitHub)

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, some OpenBao deployments intentionally limit privileged API operators from executing system code or making network connections. However, these operators can bypass both restrictions through the audit subsystem by manipulating log…

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cpe:a:openbao:openbao
  • Every version before 2.3.2
OpenBaoServers and applications · github:openbao/openbao
  • Every version before 2.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-54997
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-54997
  • GitHub Advisory Database https://github.com/advisories/GHSA-xp75-r577-cvhp
  • github.com https://github.com/openbao/openbao/security/advisories/GHSA-xp75-r577-cvhp