Detections
Analytics

SCA: security update for github.com/openbao/openbao (GHSA-prpj-rchp-9j5h)

medium Tenable Self-Hosted Container Security Plugin ID 433343

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including
 secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated,
 unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In
 OpenBao v2.2.0 and later, manually setting the configuration option
 `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global
 listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao
 release communicated on OpenBao's website, the maintainers will set this to `true` for all users and
 provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front
 of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges. (CVE-2025-52894)

See Also

https://github.com/advisories/GHSA-prpj-rchp-9j5h

Plugin Details

Severity: Medium

ID: 433343

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 8/13/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-52894

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/26/2025

Vulnerability Publication Date: 6/25/2025

Reference Information

CVE: CVE-2025-52894