7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54996

CVE-2025-54996: OpenBao Root Namespace Operator May Elevate Token Privileges

Impact

Accounts with access to the highly-privileged identity entity system in the root namespace may increase their scope directly to the root policy. While the identity system always allowed adding arbitrary policies, which in turn could contain capability grants on arbitrary paths, the root policy is restricted to manual generation using unseal or recovery key shares. The global root policy is not accessible from child namespaces.

Patches

OpenBao v2.3.2 will patch this issue.

Workarounds

Use of denied_parameters in any policy which has access to the affected identity endpoints (on identity entities) may be sufficient to prohibit this type of attack.

References

This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:

https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032
https://nvd.nist.gov/vuln/detail/cve-2025-5999

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54996

CVE-2025-54996:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openbao/openbao	go	>= 0.1.0, < 2.3.2	2.3.2
github.com/openbao/openbao	go	< 0.0.0-20250806193240-9b0b5d4f345f	0.0.0-20250806193240-9b0b5d4f345f

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handling of policy names within OpenBao's identity system. The system intended to prevent the direct assignment of the highly privileged 'root' policy. However, the checks for this policy were case-sensitive. An attacker with permissions to manage identity entities or groups could circumvent this check by providing a policy name with a different casing, such as 'Root' or 'ROOT'.

The provided patch addresses this by consistently converting all policy names to lowercase before processing them. This is evident in the changes made to the strutil.RemoveDuplicates function calls, where the second argument was changed from false to true (for lowercasing).

The identified vulnerable functions are all involved in the processing of policies for entities and groups. The handleEntityUpdateCommon, mergeEntity, and sanitizeAndUpsertGroup functions directly handle the creation and modification of policies, making them the primary vectors for this vulnerability. The filterGroupPoliciesByNS function is also included as it is part of the policy processing pipeline and was patched in a similar manner, indicating it was also a point of weakness.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.