{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-12T20:34:31.868","vulnerabilities":[{"cve":{"id":"CVE-2025-52894","sourceIdentifier":"security-advisories@github.com","published":"2025-06-25T17:15:39.677","lastModified":"2025-08-12T20:51:16.360","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao release communicated on OpenBao's website, the maintainers will set this to `true` for all users and provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges."},{"lang":"es","value":"OpenBao existe para proporcionar una solución de software que permite gestionar, almacenar y distribuir datos confidenciales, como secretos, certificados y claves. En versiones anteriores a la v2.3.0, OpenBao permitía a un atacante realizar cancelaciones no autenticadas ni auditadas de operaciones de regeneración de claves de raíz y de recuperación, lo que provocaba una denegación de servicio. En OpenBao v2.2.0 y posteriores, la configuración manual de la opción `disable_unauthed_rekey_endpoints=true` permite a un operador denegar el acceso a estos endpoints poco utilizados en escuchas globales. Hay un parche disponible en el commit fe75468822a22a88318c6079425357a02ae5b77b. En una futura versión de OpenBao, anunciada en su sitio web, los fabricantees la configurarán como `true` para todos los usuarios y ofrecerán una alternativa autenticada. Como solución alternativa, si un proxy activo o un balanceador de carga se encuentra frente a OpenBao, un operador puede rechazar solicitudes a estos endpoints desde rangos de IP no autorizados."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","versionStartIncluding":"2.2.0","versionEndExcluding":"2.3.0","matchCriteriaId":"C70EF0AA-975A-4F83-9344-CBEA54F8601B"}]}]}],"references":[{"url":"https://github.com/openbao/openbao/commit/fe75468822a22a88318c6079425357a02ae5b77b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://openbao.org/docs/deprecation","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://openbao.org/docs/deprecation/unauthed-rekey","source":"security-advisories@github.com","tags":["Product"]}]}}]}