OpenBao Root Namespace Operator May Elevate Token Privileges (CVE-2025-54996)

OpenBao is a software solution for managing sensitive data such as secrets, certificates, and keys. In versions 2.3.1 and earlier, a flaw allowed accounts with access to privileged identity entities within root namespaces to elevate their token privileges directly to the root policy. Although the identity system permitted adding arbitrary policies with capability grants on arbitrary paths, the root policy was intended to be restricted and manually generated. The vulnerability arose because the root policy was accessible beyond intended boundaries, enabling privilege escalation. This vulnerability is fixed in version 2.3.2. A mitigation includes applying denied_parameters in policies accessing the affected identity endpoints to block this attack vector.

An attacker with access to highly-privileged identity entities in root namespaces could escalate their privileges to the root policy, potentially gaining full control over sensitive data management operations. This could compromise the confidentiality and integrity of secrets, certificates, and keys managed by OpenBao. No known exploits in the wild have been reported.

A patch is available in OpenBao version 2.3.2 that fixes this vulnerability. Users should upgrade to version 2.3.2 or later. As a workaround, applying denied_parameters in any policy that has access to the affected identity endpoints may prevent exploitation. No additional action is required if the patch is applied.