Unauthorized Code Execution in OpenBao by Privileged Operators

CVE-2025-54997

What is CVE-2025-54997?

The OpenBao software, designed for managing sensitive data including secrets, certificates, and keys, has a vulnerability affecting versions 2.3.1 and below. Privileged API operators, who should be restricted from executing system code or establishing network connections, can circumvent these limitations via the audit subsystem by manipulating log prefixes. This exploit leads to unauthorized code execution and network access, undermining the platform's intended security measures. Users are advised to upgrade to version 2.3.2 or implement explicit deny policies to safeguard the sys/audit/* endpoints, although note that root operators may remain unrestricted.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References