Privilege Escalation in OpenBao Identity Management System

CVE-2025-64761

What is CVE-2025-64761?

OpenBao, an open-source identity-based secrets management system, contains a vulnerability that allows a privileged operator to exploit the identity group subsystem. Specifically, operators with access to identity/groups endpoints can add root policies to group identities, enabling them or others to escalate permissions within the system. This poses a significant risk, especially when an operator lacks policy access yet can leverage the root namespace to gain unauthorized privileges. The issue has been addressed in version 2.4.4.

References