CVE-2025-52894— OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation

OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao release communicated on OpenBao's website, the maintainers will set this to `true` for all users and provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges.

N/A

输入验证不恰当

OpenBao 输入验证错误漏洞

OpenBao是OpenBao开源的一个敏感数据管理软件。 OpenBao 2.3.0之前版本存在输入验证错误漏洞，该漏洞源于允许未经身份验证取消根密钥重新生成操作，可能导致拒绝服务。

N/A

N/A