CVE-2025-64761: GO-2025-4156 - OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation in github.com/openbao/openbao
CVE-2025-64761 · Severity: high · CVSS 7.2 · Published 2025-11-25
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.
Yes. github.com/openbao/openbao (Go): upgrade to 2.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-64761?
Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
github.com/openbao/openbao (Go): upgrade to 2.4.4 or later