https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 01:30:10 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-11281 bdu:2025-11281 https://cve.radiocsirt.org/vuln/bdu:2025-11281 https://cve.radiocsirt.org/vuln/bit-openbao-2025-54998 <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. This is fixed in version 2.3.2. To work around this issue, existing users may apply rate-limiting quotas on the authentication endpoints:, see https://openbao.org/api-docs/system/rate-limit-quotas/.</p> <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. This is fixed in version 2.3.2. To work around this issue, existing users may apply rate-limiting quotas on the authentication endpoints:, see https://openbao.org/api-docs/system/rate-limit-quotas/.</p> https://cve.radiocsirt.org/vuln/bit-openbao-2025-54998 https://cve.radiocsirt.org/vuln/cnvd-2025-18599 cnvd-2025-18599 https://cve.radiocsirt.org/vuln/cnvd-2025-18599 https://cve.radiocsirt.org/vuln/euvd-2026-249397 EUVD-2026-249397 https://cve.radiocsirt.org/vuln/euvd-2026-249397 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54998 <p>OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. This is fixed in version 2.3.2. To work around this issue, existing users may apply rate-limiting quotas on the authentication endpoints:, see https://openbao.org/api-docs/system/rate-limit-quotas/.</p> <p>OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. This is fixed in version 2.3.2. To work around this issue, existing users may apply rate-limiting quotas on the authentication endpoints:, see https://openbao.org/api-docs/system/rate-limit-quotas/.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54998 https://cve.radiocsirt.org/vuln/ghsa-j3xv-7fxp-gfhx <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Impact</p> <p>Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions.</p> <p>### Patches</p> <p>OpenBao v2.3.2 will patch this issue.</p> <p>### Workarounds</p> <p>Existing users may apply rate-limiting quotas on the authentication endpoints: https://openbao.org/api-docs/system/rate-limit-quotas/</p> <p>### References</p> <p>This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:</p> <p>- https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035 - https://nvd.nist.gov/vuln/detail/CVE-2025-6004</p> <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Impact</p> <p>Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions.</p> <p>### Patches</p> <p>OpenBao v2.3.2 will patch this issue.</p> <p>### Workarounds</p> <p>Existing users may apply rate-limiting quotas on the authentication endpoints: https://openbao.org/api-docs/system/rate-limit-quotas/</p> <p>### References</p> <p>This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:</p> <p>- https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035 - https://nvd.nist.gov/vuln/detail/CVE-2025-6004</p> https://cve.radiocsirt.org/vuln/ghsa-j3xv-7fxp-gfhx https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1 <p>govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1855 <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um beliebigen Code auszuführen, Root-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um beliebigen Code auszuführen, Root-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1855