https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 03:04:12 +0000 https://cve.radiocsirt.org/vuln/bit-openbao-2025-64761 <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user&#39;s permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.</p> <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user&#39;s permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.</p> https://cve.radiocsirt.org/vuln/bit-openbao-2025-64761 https://cve.radiocsirt.org/vuln/euvd-2026-271232 EUVD-2026-271232 https://cve.radiocsirt.org/vuln/euvd-2026-271232 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64761 <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user&#39;s permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.</p> <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user&#39;s permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64761 https://cve.radiocsirt.org/vuln/ghsa-7ff4-jw48-3436 <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Impact</p> <p>Similar to HCSEC-2025-13 / CVE-2025-5999, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user&#39;s permissions in the system. Specifically this is an issue when:</p> <p>1. An operator in the root namespace has access to `identity/groups` endpoints. 2. An operator does not have policy access.</p> <p>Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the `sudo` capability.</p> <p>### Patches</p> <p>Patched in version 2.4.4.</p> <p>### Workarounds</p> <p>Users should audit the use of identity subsystem and deny operators access if it is not in use.</p> <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Impact</p> <p>Similar to HCSEC-2025-13 / CVE-2025-5999, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user&#39;s permissions in the system. Specifically this is an issue when:</p> <p>1. An operator in the root namespace has access to `identity/groups` endpoints. 2. An operator does not have policy access.</p> <p>Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the `sudo` capability.</p> <p>### Patches</p> <p>Patched in version 2.4.4.</p> <p>### Workarounds</p> <p>Users should audit the use of identity subsystem and deny operators access if it is not in use.</p> https://cve.radiocsirt.org/vuln/ghsa-7ff4-jw48-3436 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15767-1 <p>openbao-2.4.4-1.1 on GA media</p> <p>openbao-2.4.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15767-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2675 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OpenBao ausnutzen, um Administratorrechte zu erlangen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OpenBao ausnutzen, um Administratorrechte zu erlangen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2675