{"id":"CVE-2025-64761","aliases":["GHSA-7ff4-jw48-3436","BIT-openbao-2025-64761","GO-2025-4156"],"title":"OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation","summary":"OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation","severity":"high","vendor":"openbao","product":"github.com/openbao/openbao","ecosystem":"go","affected":["github.com/openbao/openbao < 2.4.4"],"patched":["github.com/openbao/openbao 2.4.4"],"published":"2025-11-24","updated":"2026-07-27","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7ff4-jw48-3436","references":[{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-7ff4-jw48-3436"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64761"},{"url":"https://github.com/openbao/openbao/pull/2143"},{"url":"https://github.com/openbao/openbao/commit/16bb0ccd37a502930a289d434cbe4e7b4edd66e5"},{"url":"https://github.com/openbao/openbao/commit/747a1378c2756f86296ad9450f74f6faeecc2eb7"},{"url":"https://github.com/openbao/openbao"},{"url":"https://github.com/openbao/openbao/releases/tag/v2.4.4"}],"tags":["osv","go"],"epss":0.00363,"epssPercentile":0.30201,"ingestedAt":"2026-07-27T19:08:54.189Z","slug":"CVE-2025-64761","body":"## Overview\n\n### Impact\n\nSimilar to HCSEC-2025-13 / CVE-2025-5999, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when:\n\n1. An operator in the root namespace has access to `identity/groups` endpoints.\n2. An operator does not have policy access.\n\nOtherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the `sudo` capability.\n\n### Patches\n\nPatched in version 2.4.4. \n\n### Workarounds\n\nUsers should audit the use of identity subsystem and deny operators access if it is not in use.\n\n## Affected packages\n\n- `github.com/openbao/openbao < 2.4.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/openbao/openbao 2.4.4`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}