Openbao vulnerabilities
44 CVEs and advisories name Openbao as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-64761OpenBao Privileged Operator Identity Group Root Escalation
- CVE-2025-59048OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method
- CVE-2025-62705OpenBao and Vault Leak []byte Fields in Audit Logs
- CVE-2025-62513OpenBao leaks HTTPRawBody in Audit Logs
- CVE-2025-59043OpenBao vulnerable to denial of service via malicious JSON request processing
- CVE-2025-55003OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse
- CVE-2025-55001OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias
- CVE-2025-55000OpenBao TOTP Secrets Engine Enables Code Reuse
- CVE-2025-54999OpenBao: Timing Side-Channel in Userpass Auth Method
- CVE-2025-54998OpenBao Userpass and LDAP User Lockout Bypass
- CVE-2025-54997OpenBao: Privileged Operator May Execute Code on the Underlying Host
- CVE-2025-54996OpenBao Root Namespace Operator May Elevate Token Privileges
- CVE-2025-52894OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation
- CVE-2025-52893OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data