CVE-2025-54997

🗓️ 09 Aug 2025 01:56:45Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 56 Views🌐 WEB

OpenBao CVE-2025-54997: v2.3.1 and earlier allow audit log prefix abuse to bypass controls, enabling code and network access; fixed in 2.3.2. Workaround deny sys/audit/*; root operators cannot be restricted.

Reporter	Title	Published	Views	Family All 24
AlpineLinux	CVE-2025-54997	9 Aug 202501:56	–	alpinelinux
Circl	CVE-2025-54997	9 Aug 202504:21	–	circl
CNNVD	OpenBao 代码注入漏洞	9 Aug 202500:00	–	cnnvd
CNVD	OpenBao Code Injection Vulnerability	15 Aug 202500:00	–	cnvd
Cvelist	CVE-2025-54997 OpenBao: Privileged Operator May Execute Code on the Underlying Host	9 Aug 202501:56	–	cvelist
EUVD	EUVD-2025-24037	3 Oct 202520:07	–	euvd
Github Security Blog	Privileged OpenBao Operator May Execute Code on the Underlying Host	8 Aug 202514:37	–	github
NVD	CVE-2025-54997	9 Aug 202503:15	–	nvd
OSV	CVE-2025-54997 OpenBao: Privileged Operator May Execute Code on the Underlying Host	9 Aug 202501:56	–	osv
OSV	GHSA-XP75-R577-CVHP Privileged OpenBao Operator May Execute Code on the Underlying Host	8 Aug 202514:37	–	osv

NVD

Vulners

Node

openbao openbaoRange<2.3.2

[
  {
    "vendor": "openbao",
    "product": "openbao",
    "versions": [
      {
        "version": "< 2.3.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/openbao/openbao/releases/tag/v2.3.2
github	www.github.com/openbao/openbao/pull/1634
discuss	www.discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033
github	www.github.com/openbao/openbao/security/advisories/GHSA-xp75-r577-cvhp