Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2025-54997: OpenBao lets privileged operator run host code
CVE-2025-54997 · published 1 year ago
Summary
Versions of OpenBao up to 2.3.1 let a user with high‑level API rights bypass security limits by altering audit log prefixes, which can lead to running commands on the server or opening network connections. This breaks the intended protection for secret data. Upgrade to version 2.3.2 or later, or restrict access to the sys/audit/* endpoints with deny policies as a temporary measure.
What to do
- Update github.com openbao to version 2.3.2.
- Update github.com openbao to version 0.0.0-20250806194004-a14053c9679d.
- Update openbao openbao to version 2.3.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | openbao |
>= 0.1.0, < 2.3.2 < 0.0.0-20250806194004-a14053c9679d Fix: upgrade to 2.3.2
|
| – | openbao | openbao |
< 2.3.2 cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:* |
Original advisory text
OpenBao: Privileged Operator May Execute Code on the Underlying Host
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, some OpenBao deployments intentionally limit privileged API operators from executing system code or making network connections. However, these operators can bypass both restrictions through the audit subsystem by manipulating log prefixes. This allows unauthorized code execution and network access that violates the intended security model. This issue is fixed in version 2.3.2. To workaround, users can block access to sys/audit/* endpoints using explicit deny policies, but root operators cannot be restricted this way.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-6000
- https://github.com/openbao/openbao/commit/a14053c9679d6e9cf370f00cf933476cda6d84...
- https://github.com/advisories/GHSA-xp75-r577-cvhp
- https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-exec... URL
- https://github.com/openbao/openbao/releases/tag/v2.3.2 URL
- https://github.com/openbao/openbao/security/advisories/GHSA-xp75-r577-cvhp Vendor Advisory
- https://github.com/openbao/openbao/pull/1634 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54997... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-54997 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-94Code Injection
Timeline
Published9 Aug 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta