CVE-2025-54997

Katalog CVE

CVSS 9.1 · Critical EPSS 0,40%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada openbao. Skor CVSS 3.1 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, some OpenBao deployments intentionally limit privileged API operators from executing system code or making network connections. However, these operators can bypass both restrictions through the audit subsystem by manipulating log prefixes. This allows unauthorized code execution and network access that violates the intended security model. This issue is fixed in version 2.3.2. To workaround, users can block access to sys/audit/* endpoints using explicit deny policies, but root operators cannot be restricted this way.

Rincian

Terbit di NVD

9 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openbao/openbao/security/advisories/GHSA-xp75-r577-cvhp advisory vendor
• https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-hos... not applicable
• https://github.com/openbao/openbao/pull/1634 issue tracking
• https://github.com/openbao/openbao/releases/tag/v2.3.2 release notes