Threats Tagged 'cve-2025-54997'

OpenBao versions 2.3.1 and below contain a critical vulnerability that allows privileged API operators to bypass intended restrictions on system code execution and network connections via the audit subsystem. By manipulating log prefixes, these operators can execute unauthorized code and access the network, violating the security model. This issue is fixed in version 2.3.2. As a workaround, users can block access to sys/audit/* endpoints with explicit deny policies, but root operators cannot be restricted this way.