OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-45a7dd8f10 advisory.

    update to upstream 2.4.4, which fixed CVE-2025-64761

    ----

    Adds hsm tag.

    The fedora-41 build was done with golang-1.24.10 which fixed CVE-2025-58189, CVE-2025-61725,     CVE-2025-61723, CVE-2025-58185,  and CVE-2025-58183.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged
    operator could use the identity group subsystem to add a root policy to a group identity group, escalating
    their or another user's permissions in the system. Specifically this is an issue when: an operator in the
    root namespace has access to identity/groups endpoints and an operator does not have policy access.
    Otherwise, an operator with policy access could create or modify an existing policy to grant root-
    equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.
    (CVE-2025-64761)

ID	Name	Product	Family	Severity
277351	Fedora 41 : openbao (2025-45a7dd8f10)	Nessus	Fedora Local Security Checks	high
436156	SCA: security update for github.com/openbao/openbao (GHSA-7ff4-jw48-3436)	Tenable Cloud Security	SCA Checks	high
436156	SCA: security update for github.com/openbao/openbao (GHSA-7ff4-jw48-3436)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-64761

high

Tenable Plugins

high

high

high