Skip to content
OpenAdvisories

Vendor

openbao

48 known vulnerabilities.

Products

openbao 47 openbao-plugins 1
All Critical High Medium Low Exploited only Public exploit

48 results · Feed

  • Medium 6.5
    CVE-2025-55001

    OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, cho…

    openbao openbao github.com/openbao/openbao Go
  • Medium 6.5
    CVE-2025-55000

    OpenBao TOTP Secrets Engine Enables Code Reuse

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictl…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Low 3.7
    CVE-2025-54999

    OpenBao: Timing Side-Channel in Userpass Auth Method

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing di…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Medium 5.3
    CVE-2025-54998

    OpenBao Userpass and LDAP User Lockout Bypass

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or L…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Critical 9.1
    CVE-2025-54997

    OpenBao: Privileged Operator May Execute Code on the Underlying Host

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, some OpenBao deployments intentionally limit privileged API operators from executing system c…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • High 7.2
    CVE-2025-54996

    OpenBao Root Namespace Operator May Elevate Token Privileges

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, accounts with access to highly-privileged identity entity systems in root namespaces were abl…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Medium 6.9
    CVE-2025-52894

    OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery re…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Medium 4.5
    CVE-2025-52893

    OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the ear…

    openbao openbao openbao golang-github-go-viper-mapstructure Ubuntu Alpine Go