CyberRota Analysis
AI-GeneratedOpenBao versions prior to 2.5.5 are vulnerable to a namespace canonicalization issue that allows users with specific capabilities to exploit the /sys/namespaces/root endpoint, potentially enabling unauthorized access to perform lookups, deletions, or modifications within the containing namespace. The impact is limited to non-root namespaces, where ACL checks fail due to improper handling of the root path. Organizations using OpenBao for identity-based secrets management should prioritize upgrading to version 2.5.5 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/* endpoint family can resolve its containing namespace through a path prefix or X-Vault-Namespace header. ACL checks occurred before root canonicalized to an empty path, causing /sys/namespaces/root to resolve to the system backend's containing namespace and allowing permitted lookups, deletion, locking, or custom metadata changes against that direct containing namespace. The root namespace and arbitrary unrelated namespaces are not affected, and available operations depend on the capabilities granted on the path and subpaths such as /api-lock. This issue is fixed in version 2.5.5.