CVE-2025-52894
📋 TL;DR
OpenBao before version 2.3.0 allows unauthenticated attackers to cancel root rekey and recovery rekey operations, causing denial of service. This affects all OpenBao deployments with default configurations. The vulnerability is present in OpenBao versions before 2.3.0.
💻 Affected Systems
- OpenBao
📦 What is this software?
Openbao by Openbao
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of OpenBao operations by repeatedly canceling critical rekey operations, preventing legitimate key rotation and potentially locking out administrators.
Likely Case
Temporary denial of service affecting rekey operations, requiring manual intervention to restart the process.
If Mitigated
Minimal impact if proper authentication controls or network restrictions are in place.
🎯 Exploit Status
Simple HTTP requests to specific endpoints can trigger the vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenBao 2.3.0
Vendor Advisory: https://github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h
Restart Required: Yes
Instructions:
1. Upgrade OpenBao to version 2.3.0 or later. 2. Restart the OpenBao service. 3. Verify the upgrade was successful.
🔧 Temporary Workarounds
Configuration mitigation
allSet disable_unauthed_rekey_endpoints=true in OpenBao configuration for versions 2.2.0+
Set 'disable_unauthed_rekey_endpoints = true' in OpenBao configuration file
Network access control
allUse proxy/load balancer to block unauthorized access to rekey endpoints
Configure firewall/proxy to deny requests to /v1/sys/rekey/init and /v1/sys/rekey/update from unauthorized IPs
🧯 If You Can't Patch
- Implement network segmentation to restrict access to OpenBao endpoints
- Deploy WAF or reverse proxy with strict access controls for rekey endpoints
🔍 How to Verify
Check if Vulnerable:
Check OpenBao version with 'openbao version' command. If version is below 2.3.0, system is vulnerable.Check Version:
openbao versionVerify Fix Applied:
Verify OpenBao version is 2.3.0 or higher, or check configuration for disable_unauthed_rekey_endpoints=true setting.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to /v1/sys/rekey/init or /v1/sys/rekey/update endpoints
- Multiple rekey operation cancellations in short time
Network Indicators:
- HTTP POST requests to rekey endpoints from unauthorized sources
- Unusual traffic patterns to OpenBao rekey endpoints
SIEM Query:
source="openbao" AND (uri_path="/v1/sys/rekey/init" OR uri_path="/v1/sys/rekey/update") AND http_status=200 AND auth_status="unauthenticated"