6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-52894

CVE-2025-52894: OpenBao allows cancellation of root rekey and recovery rekey operations without authentication

Impact

OpenBao and HashiCorp Vault allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service.

Patches

In OpenBao v2.2.2 and later, manually setting the configuration option disable_unauthed_rekey_endpoints=true allows an operator to deny these rarely-used endpoints on global listeners.

In a future OpenBao release communicated on our website, we will set this to true for all users and provide an authenticated alternative.

This vulnerability has been disclosed to HashiCorp; see their website for more information.

Workarounds

If an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges.

References

See the deprecation notice.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-52894

CVE-2025-52894:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openbao/openbao/api/v2	go	>= 2.2.2, <= 2.3.0	2.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an unauthenticated attacker to cancel rekey and recovery rekey operations, leading to a denial of service. The analysis of the patch commit fe75468822a22a88318c6079425357a02ae5b77b reveals that the root cause was the unconditional registration of sensitive API endpoints.

The http/handler.go file contains the handler function, which sets up the HTTP routes. Before the patch, this function registered handlers for /v1/sys/rekey/* and /v1/sys/rekey-recovery-key/* without any authentication mechanism. This allowed anyone with network access to the OpenBao listener to interact with these endpoints.

The primary vulnerable function is handleSysRekeyInit, which handles DELETE requests to cancel rekey operations. The functions handleSysRekeyUpdate and handleSysRekeyVerify were also exposed and part of the overall vulnerable, unauthenticated rekey process.

The patch introduces a new configuration option, disable_unauthed_rekey_endpoints, which defaults to false for backward compatibility but will be changed to true in a future release. The handler function was modified to check this configuration before registering the rekey endpoints, thus mitigating the vulnerability by allowing operators to disable these unauthenticated endpoints.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-52894: OpenBao allows cancellation of root rekey and recovery rekey operations without authentication

Impact

Patches

Workarounds

References

CVE-2025-52894:

6.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

6.9

6.9

Basic Information

Basic Information

CVE-2025-52894: OpenBao allows cancellation of root rekey and recovery rekey operations without authentication

Impact

Patches

Workarounds

References

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI