CVE-2025-64761
Description
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.
How to fix
- openbao openbao2.4.4 or later
- github.com/openbao/openbao2.4.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openbao openbao | v < 2.4.4 | 2.4.4 |
| github.com/openbao/openbaoGo | v < 2.4.4, No range specified | 2.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.