https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T07:43:10.660969+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-11281 bdu:2025-11281 2026-10-04T07:43:10.752005+00:00 bdu:2025-11281 https://cve.radiocsirt.org/vuln/bit-openbao-2025-54998 BIT-openbao-2025-54998 — OpenBao Userpass and LDAP User Lockout Bypass 2026-10-04T07:43:10.752052+00:00

Affected: Bitnami: openbao

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. This is fixed in version 2.3.2. To work around this issue, existing users may apply rate-limiting quotas on the authentication endpoints:, see https://openbao.org/api-docs/system/rate-limit-quotas/.

 https://cve.radiocsirt.org/vuln/cnvd-2025-18599 cnvd-2025-18599 2026-10-04T07:43:10.752101+00:00 cnvd-2025-18599 https://cve.radiocsirt.org/vuln/euvd-2026-249397 EUVD-2026-249397 2026-10-04T07:43:10.752121+00:00 EUVD-2026-249397 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54998 fkie_cve-2025-54998 2026-10-04T07:43:10.752139+00:00

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. This is fixed in version 2.3.2. To work around this issue, existing users may apply rate-limiting quotas on the authentication endpoints:, see https://openbao.org/api-docs/system/rate-limit-quotas/.

 https://cve.radiocsirt.org/vuln/ghsa-j3xv-7fxp-gfhx GHSA-j3xv-7fxp-gfhx — OpenBao Userpass and LDAP User Lockout Bypass 2026-10-04T07:43:10.752176+00:00

Affected: Go: github.com/openbao/openbao

### Impact

Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions.

### Patches

OpenBao v2.3.2 will patch this issue.

### Workarounds

Existing users may apply rate-limiting quotas on the authentication endpoints: https://openbao.org/api-docs/system/rate-limit-quotas/

### References

This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:

- https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035 - https://nvd.nist.gov/vuln/detail/CVE-2025-6004

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1 openSUSE-SU-2025:15434-1 — govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media 2026-10-04T07:43:10.752255+00:00

govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1855 WID-SEC-W-2025-1855 — OpenBao: Mehrere Schwachstellen 2026-10-04T07:43:10.752295+00:00

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um beliebigen Code auszuführen, Root-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.