Listen to this Post
How the Mentioned CVE Works:
CVE-2025-64761 is a privilege escalation flaw in the OpenBao identity and secrets manager. It exploits the identity group subsystem’s authorization logic. A privileged operator with access to manage identity groups (identity/groups endpoints) in the root namespace, but without direct policy write permissions, can manipulate group membership. The vulnerability allows this operator to add a root policy to a group’s linked policies. When an identity (user or service) belonging to that group authenticates, OpenBao evaluates the group’s policies cumulatively. By attaching the root policy, the operator effectively grants any member of that group full administrative rights (sudo capability) over the entire OpenBao instance, bypassing intended permission boundaries and escalating privileges to root level.
DailyCVE Form:
Platform: OpenBao
Version: < 2.4.4
Vulnerability: Privilege Escalation
Severity: Critical
Date: 2025-11-24
Prediction: 2025-12-08
What Undercode Say:
Analytics:
$ curl -H "X-Vault-Token: $OPERATOR_TOKEN" \
-X POST $OPENBAO_ADDR/v1/identity/group/id/<group_id> \
-d '{"policies": ["root", "default"]}'
Check effective policies for an identity
$ curl -H "X-Vault-Token: $USER_TOKEN" \
$OPENBAO_ADDR/v1/auth/token/lookup-self | jq .data.policies
How Exploit:
- Attacker with group management privileges identifies a target group.
- They send a POST request to modify the group, adding the “root” policy to its policy list.
- Any member of that group (including the attacker if added) now has root privileges.
Protection from this CVE:
Immediately upgrade to OpenBao version 2.4.4 or later.
Impact:
Full System Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
