CVE-2025-52894Medium▾ SunlitOpenBao allows cancellation of root rekey and recovery rekey operations without authentication
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
0.3% → 0.4%
OpenBao and HashiCorp Vault allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service.
In OpenBao v2.2.2 and later, manually setting the configuration option disable_unauthed_rekey_endpoints=true allows an operator to deny these rarely-used endpoints on global listeners.
In a future OpenBao release communicated on our website, we will set this to true for all users and provide an authenticated alternative.
This vulnerability has been disclosed to HashiCorp; see their website for more information.
If an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges.
See the deprecation notice.
github.com/openbao/openbao >= 0.1.0github.com/openbao/openbao < 0.0.0-20250625150133-fe75468822a2Upgrade to a patched release:
github.com/openbao/openbao 0.0.0-20250625150133-fe75468822a2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45808HighOpenBao is an open source identity-based secrets management system
CVE-2026-46358MediumOpenBao is an open source identity-based secrets management system
CVE-2026-46405Medium· 5.3OpenBao is an open source identity-based secrets management system
CVE-2025-54997Critical· 9.1Privileged OpenBao Operator May Execute Code on the Underlying Host
CVE-2026-42186LowOpenBao's Namespace Deletion May Not Delete Data Properly
CVE-2025-54996High· 7.2OpenBao Root Namespace Operator May Elevate Token Privileges