CVE-2025-52894
Last modified
CVE-2025-52894 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao release communicated on OpenBao's website, the maintainers will set this to `true` for all users and provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openbao | Openbao | >= 2.2.0, < 2.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-52894?
How severe is CVE-2025-52894?
How do I fix CVE-2025-52894?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-52889Incus is a system container and virtual machine manager. Whe…3.4
- CVE-2025-5289The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipboo…5.4
- CVE-2025-52890Incus is a system container and virtual machine manager. Whe…8.1
- CVE-2025-52891ModSecurity is an open source, cross platform web applicatio…6.5
- CVE-2025-52892EspoCRM is a web application with a frontend designed as a s…6.5
- CVE-2025-52893OpenBao exists to provide a software solution to manage, sto…4.5
- CVE-2025-52895Frappe is a full-stack web application framework. Prior to v…7.5
- CVE-2025-52896Frappe is a full-stack web application framework. Prior to v…5.4
- CVE-2025-52897GLPI is a Free Asset and IT Management Software package. In …6.1
- CVE-2025-52898Frappe is a full-stack web application framework. Prior to v…8.8
- CVE-2025-52899Tuleap is an Open Source Suite created to facilitate managem…5.3
- CVE-2025-5290The Borderless – Elementor Addons and Templates plugin for W…6.4
Are you affected by CVE-2025-52894?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST