OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation (CVE-2025-52894)

OpenBao, a software solution for managing sensitive data such as secrets, certificates, and keys, has a vulnerability (CVE-2025-52894) in versions >=2.2.2 <2.3.1 that permits unauthenticated cancellation of root and recovery rekey operations. This flaw can lead to denial of service by interrupting critical rekey processes. The vulnerability is mitigated by setting the configuration option `disable_unauthed_rekey_endpoints=true` to deny access to these endpoints. A patch commit (fe75468822a22a88318c6079425357a02ae5b77b) is available, and future OpenBao releases will enable this setting by default and introduce authenticated alternatives.

The vulnerability allows an attacker to cancel root and recovery rekey operations without authentication or audit, which can disrupt key management processes and cause denial of service. There is no indication of data disclosure or privilege escalation. No known exploits in the wild have been reported.

A patch is available and should be applied to upgrade OpenBao to a version >=2.3.1. Operators can also manually set the configuration option `disable_unauthed_rekey_endpoints=true` in versions >=2.2.2 <2.3.1 to disable the vulnerable endpoints. Additionally, restricting access to these endpoints via an active proxy or load balancer by denying unauthorized IP ranges can serve as a temporary workaround. Future releases will enable this protection by default and provide authenticated alternatives, so upgrading when available is recommended.