Cross-Account IAM Role Impersonation Vulnerability in OpenBao's AWS Plugin

CVE-2025-59048

What is CVE-2025-59048?

OpenBao's AWS Plugin allows for the generation of AWS access credentials through IAM policies. Before the release of version 0.1.1, this plugin is susceptible to cross-account IAM role impersonation, permitting roles from untrusted AWS accounts to authenticate as trusted roles bearing the same name. This vulnerability is particularly concerning in multi-account AWS setups where IAM role names are not unique, potentially leading to unauthorized access and data breaches. The issue has been remediated in version 0.1.1. To mitigate risks, ensure IAM role names are unique across all AWS accounts interacting with OpenBao, and regularly audit for any duplicate IAM roles.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References