GHSA-7ff4-jw48-3436 — high GitHub Advisory (CVE-2025-64761) in go/github.com/openbao/openbao

Description

Impact

Similar to HCSEC-2025-13 / CVE-2025-5999, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when:

An operator in the root namespace has access to identity/groups endpoints.
An operator does not have policy access.

Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability.

Patches

Patched in version 2.4.4.

Workarounds

Users should audit the use of identity subsystem and deny operators access if it is not in use.

Basic information

Type: reviewed
Severity: high
Advisory on GitHub: Open advisory ↗
Repository advisory: Open repository advisory ↗
Source code: Browse source ↗
Published (advisory): 2025-11-24 21:51:18 UTC
Updated: 2025-11-27 07:58:34 UTC
GitHub reviewed: 2025-11-24 21:51:18 UTC
NVD published: 2025-11-24

Score	Percentile
0.05%	15.88%

CVSS Scores

Base score	Version	Severity	Vector
7.5	4.0	—	`CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network. Attack complexity (AC:L) Exploitation conditions are straightforward and stable. Attack requirements (AT:P) Additional preconditions must be present for exploitation. Privileges required (PR:H) High privileges are required. User interaction (UI:N) No user interaction is required. Vulnerable system confidentiality impact (VC:H) High confidentiality impact on the vulnerable system. Vulnerable system integrity impact (VI:H) High integrity impact on the vulnerable system. Vulnerable system availability impact (VA:H) High availability impact on the vulnerable system. Subsequent system confidentiality impact (SC:N) No confidentiality impact on subsequent systems. Subsequent system integrity impact (SI:N) No integrity impact on subsequent systems. Subsequent system availability impact (SA:N) No availability impact on subsequent systems.

Identifiers

Type	Value
GHSA	GHSA-7ff4-jw48-3436 ↗
CVE	CVE-2025-64761 ↗

CWEs

CWE id	Name
CWE-266	Incorrect Privilege Assignment
CWE-269	Improper Privilege Management

Credits

cipherboy (finder)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
go	github.com/openbao/openbao	< 2.4.4	2.4.4	—

OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation