https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T04:05:41.012459+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-openbao-2025-64761 BIT-openbao-2025-64761 — OpenBao Privileged Operator Identity Group Root Escalation 2026-10-15T04:05:41.016325+00:00

Affected: Bitnami: openbao

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.

 https://cve.radiocsirt.org/vuln/euvd-2026-271232 EUVD-2026-271232 2026-10-15T04:05:41.016376+00:00 EUVD-2026-271232 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64761 fkie_cve-2025-64761 2026-10-15T04:05:41.016393+00:00

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.

 https://cve.radiocsirt.org/vuln/ghsa-7ff4-jw48-3436 GHSA-7ff4-jw48-3436 — OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation 2026-10-15T04:05:41.016418+00:00

Affected: Go: github.com/openbao/openbao

### Impact

Similar to HCSEC-2025-13 / CVE-2025-5999, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when:

1. An operator in the root namespace has access to `identity/groups` endpoints. 2. An operator does not have policy access.

Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the `sudo` capability.

### Patches

Patched in version 2.4.4.

### Workarounds

Users should audit the use of identity subsystem and deny operators access if it is not in use.

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15767-1 openSUSE-SU-2025:15767-1 — openbao-2.4.4-1.1 on GA media 2026-10-15T04:05:41.016446+00:00

openbao-2.4.4-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2675 WID-SEC-W-2025-2675 — OpenBao: Schwachstelle ermöglicht Erlangen von Administratorrechten 2026-10-15T04:05:41.016463+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OpenBao ausnutzen, um Administratorrechte zu erlangen.