OpenBao allows cancellation of root rekey and recovery rekey operations without authentication
MediumCVE-2025-52894 · Published Jun 26, 2025 · updated Jul 27, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | >= 0.1.0 | No fix yet |
| < 0.0.0-20250625150133-fe75468822a2 | 0.0.0-20250625150133-fe75468822a2 |
Details and references
### Impact OpenBao and HashiCorp Vault allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. ### Patches In OpenBao v2.2.2 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. In a future OpenBao release [communicated on our website](https://openbao.org/docs/deprecation/), we will set this to `true` for all users and provide an authenticated alternative. This vulnerability has been disclosed to HashiCorp; see their website for more information. ### Workarounds If an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges. ### References See the [deprecation notice](https://openbao.org/docs/deprecation/unauthed-rekey/).
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-20, CWE-306
- Also known as
- BIT-openbao-2025-52894, CVE-2025-52894, GO-2025-3783
- github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h
- nvd.nist.gov/vuln/detail/CVE-2025-52894
- github.com/openbao/openbao/commit/fe75468822a22a88318c6079425357a02ae5b77b
- github.com/openbao/openbao
- github.com/openbao/openbao/releases/tag/v2.3.1
- openbao.org/docs/deprecation
- openbao.org/docs/deprecation/unauthed-rekey
- pkg.go.dev/vuln/GO-2025-3783
More openbao advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 82025 | OpenBao Root Namespace Operator May Elevate Token Privileges CVE-2025-54996High7.2fixed in 0.0.0-20250806193240-9b0b5d4f345f, 2.3.2 | High7.2 | 0.0.0-20250806193240-9b0b5d4f345f, 2.3.2 |
| Aug 82025 | Privileged OpenBao Operator May Execute Code on the Underlying Host CVE-2025-54997Critical9.1fixed in 0.0.0-20250806194004-a14053c9679d, 2.3.2 | Critical9.1 | 0.0.0-20250806194004-a14053c9679d, 2.3.2 |
| Aug 82025 | OpenBao Userpass and LDAP User Lockout Bypass CVE-2025-54998Medium5.3fixed in 0.0.0-20250807212521-c52795c1ef74, 2.3.2 | Medium5.3 | 0.0.0-20250807212521-c52795c1ef74, 2.3.2 |
| Aug 82025 | OpenBao has a Timing Side-Channel in the Userpass Auth Method CVE-2025-54999Low3.7fixed in 0.0.0-20250806193356-4d9b5d3d6486, 2.3.2 | Low3.7 | 0.0.0-20250806193356-4d9b5d3d6486, 2.3.2 |
| Aug 82025 | OpenBao TOTP Secrets Engine Code Reuse CVE-2025-55000Medium6.5fixed in 0.0.0-20250806193153-183891f8d535, 2.3.2 | Medium6.5 | 0.0.0-20250806193153-183891f8d535, 2.3.2 |
| Aug 82025 | OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse CVE-2025-55003Medium5.7fixed in 0.0.0-20250807113757-8340a6918f6c, 2.3.2 | Medium5.7 | 0.0.0-20250807113757-8340a6918f6c, 2.3.2 |