CVE-2025-54996 OpenBao Root Namespace Operator May Elevate Token Privileges

High 7.2 Published 9 Aug 2025 Updated 11 Aug 2025

Root namespace operators can escalate privileges to the global root policy, bypassing intended restrictions on high-privilege access.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-54996?

CVE-2025-54996 is a high-severity vulnerability in openbao, published on 9 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, accounts with access to highly-privileged identity entity systems in root namespaces were able to increase their scope directly to the root policy. While the identity system allowed adding arbitrary policies, which in turn could contain capability grants on arbitrary paths, the root policy was restricted to manual generation using unseal or recovery key shares. The global root policy was not accessible from child namespaces. This issue is fixed in version 2.3.2. To workaround this vulnerability, use of denied_parameters in any policy which has access to the affected identity endpoints (on identity entities) may be sufficient to prohibit this type of attack.

Weakness: CWE-269

Which versions are affected by CVE-2025-54996?

6 open source packages ship an affected version, including github.com/openbao/openbao and openbao. It affects 1 product.

Package	Affected	Fixed in
`github.com/openbao/openbao` Go	All versions	`0.0.0-20250806193240-9b0b5d4f345f`
`github.com/openbao/openbao` Go	All versions	`0.0.0-20250806193240-9b0b5d4f345f`
`github.com/openbao/openbao` Go	All versions	`0.0.0-20250806193240-9b0b5d4f345f`
`github.com/openbao/openbao` Go	From `0.1.0`	`2.3.2`
`github.com/openbao/openbao` Go	From `0.1.0`	`2.3.2`
`openbao` Bitnami	All versions	`0.0.0-20250806193240-9b0b5d4f345f, 2.3.2`

Products include Openbao Openbao.

How do I fix CVE-2025-54996?

Upgrade github.com/openbao/openbao to a fixed version for your release line: 0.0.0-20250806193240-9b0b5d4f345f or 2.3.2.

Is CVE-2025-54996 being exploited?

There is no known exploitation of CVE-2025-54996 in the wild and no public exploit code.

Sources

Also known as BIT-openbao-2025-54996, GHSA-vf84-mxrq-crqc, GO-2025-3857.