Cross-Account IAM Role Impersonation Vulnerability in OpenBao's AWS Plugin
CVE-2025-59048

8.1HIGH

Key Information:

Vendor

Openbao

Status
Openbao-plugins
Vendor
CVE Published:
23 October 2025

What is CVE-2025-59048?

OpenBao's AWS Plugin allows for the generation of AWS access credentials through IAM policies. Before the release of version 0.1.1, this plugin is susceptible to cross-account IAM role impersonation, permitting roles from untrusted AWS accounts to authenticate as trusted roles bearing the same name. This vulnerability is particularly concerning in multi-account AWS setups where IAM role names are not unique, potentially leading to unauthorized access and data breaches. The issue has been remediated in version 0.1.1. To mitigate risks, ensure IAM role names are unique across all AWS accounts interacting with OpenBao, and regularly audit for any duplicate IAM roles.

Affected Version(s)

openbao-plugins < 0.1.1

References

https://github.com/openbao/openbao-plugins/security/advis...
x_refsource_CONFIRM
https://github.com/openbao/openbao-plugins/commit/2a77af3...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.