CVE-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation

What is CVE-2025-64761?

CVE-2025-64761 is a high-severity vulnerability in openbao, published on 25 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.

Weakness: CWE-266

Which versions are affected by CVE-2025-64761?

4 open source packages ship an affected version, including github.com/openbao/openbao and openbao. It affects 1 product.

Products include Openbao Openbao.

How do I fix CVE-2025-64761?

Upgrade github.com/openbao/openbao to 2.4.4 or later.

Is CVE-2025-64761 being exploited?

There is no known exploitation of CVE-2025-64761 in the wild and no public exploit code.

Other vulnerabilities in openbao

• CVE-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode Critical 9.6
• CVE-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message Critical 9.4
• CVE-2025-54997 OpenBao: Privileged Operator May Execute Code on the Underlying Host Critical 9.1
• CVE-2025-59043 OpenBao vulnerable to denial of service via malicious JSON request processing High 7.5
• CVE-2025-54996 OpenBao Root Namespace Operator May Elevate Token Privileges High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-openbao-2025-64761, GHSA-7ff4-jw48-3436, GO-2025-4156, openSUSE-SU-2025:15767-1.