---
id: CVE-2025-52894
aliases:
  - GHSA-prpj-rchp-9j5h
  - BIT-openbao-2025-52894
  - GO-2025-3783
title: >-
  OpenBao allows cancellation of root rekey and recovery rekey operations
  without authentication
summary: >-
  OpenBao allows cancellation of root rekey and recovery rekey operations
  without authentication
severity: medium
vendor: openbao
product: github.com/openbao/openbao
ecosystem: go
affected:
  - github.com/openbao/openbao >= 0.1.0
  - github.com/openbao/openbao < 0.0.0-20250625150133-fe75468822a2
patched:
  - github.com/openbao/openbao 0.0.0-20250625150133-fe75468822a2
published: '2025-06-26'
updated: '2026-07-27'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-prpj-rchp-9j5h'
references:
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-52894'
  - url: >-
      https://github.com/openbao/openbao/commit/fe75468822a22a88318c6079425357a02ae5b77b
  - url: 'https://github.com/openbao/openbao'
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.3.1'
  - url: 'https://openbao.org/docs/deprecation'
  - url: 'https://openbao.org/docs/deprecation/unauthed-rekey'
  - url: 'https://pkg.go.dev/vuln/GO-2025-3783'
tags:
  - osv
  - go
epss: 0.00366
epssPercentile: 0.30454
ingestedAt: '2026-07-27T19:08:54.988Z'
---

## Overview

### Impact

OpenBao and HashiCorp Vault allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service.

### Patches

In OpenBao v2.2.2 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners.

In a future OpenBao release [communicated on our website](https://openbao.org/docs/deprecation/), we will set this to `true` for all users and provide an authenticated alternative.

This vulnerability has been disclosed to HashiCorp; see their website for more information. 

### Workarounds

If an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges.

### References

See the [deprecation notice](https://openbao.org/docs/deprecation/unauthed-rekey/).

## Affected packages

- `github.com/openbao/openbao >= 0.1.0`
- `github.com/openbao/openbao < 0.0.0-20250625150133-fe75468822a2`

## Remediation

Upgrade to a patched release:

- `github.com/openbao/openbao 0.0.0-20250625150133-fe75468822a2`