---
id: CVE-2025-64761
aliases:
  - GHSA-7ff4-jw48-3436
  - BIT-openbao-2025-64761
  - GO-2025-4156
title: OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation
summary: OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation
severity: high
vendor: openbao
product: github.com/openbao/openbao
ecosystem: go
affected:
  - github.com/openbao/openbao < 2.4.4
patched:
  - github.com/openbao/openbao 2.4.4
published: '2025-11-24'
updated: '2026-07-27'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7ff4-jw48-3436'
references:
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-7ff4-jw48-3436'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64761'
  - url: 'https://github.com/openbao/openbao/pull/2143'
  - url: >-
      https://github.com/openbao/openbao/commit/16bb0ccd37a502930a289d434cbe4e7b4edd66e5
  - url: >-
      https://github.com/openbao/openbao/commit/747a1378c2756f86296ad9450f74f6faeecc2eb7
  - url: 'https://github.com/openbao/openbao'
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.4.4'
tags:
  - osv
  - go
epss: 0.00363
epssPercentile: 0.27409
ingestedAt: '2026-07-27T19:08:54.189Z'
---

## Overview

### Impact

Similar to HCSEC-2025-13 / CVE-2025-5999, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when:

1. An operator in the root namespace has access to `identity/groups` endpoints.
2. An operator does not have policy access.

Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the `sudo` capability.

### Patches

Patched in version 2.4.4. 

### Workarounds

Users should audit the use of identity subsystem and deny operators access if it is not in use.

## Affected packages

- `github.com/openbao/openbao < 2.4.4`

## Remediation

Upgrade to a patched release:

- `github.com/openbao/openbao 2.4.4`