Openbao CVE-2025-52894

The CVSS 7.5 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates high availability impact with minimal attack complexity—any network-connected attacker can trigger the vulnerability without authentication or special conditions. The attack vector is network-based and requires no user interaction, making exploitation trivial. However, real-world risk depends on: (1) whether the vulnerability is actively exploited (KEV status not provided in data), (2) whether public POC code exists (not mentioned), and (3) the operational impact of rekey cancellation. From a SSVC perspective, this is automatable and has high technical impact (denial of administrative function), but the blast radius is limited to availability of rekey operations rather than compromise of secrets themselves. Organizations running OpenBao v2.2.0+ already have a mitigation path via disable_unauthed_rekey_endpoints=true. This is a legitimate priority vulnerability for OpenBao deployments, particularly those exposed to untrusted networks, but the availability-only impact (no confidentiality/integrity breach) places it below critical severity for most organizations.

An attacker on the network (or with access to the OpenBao API endpoint) sends an unauthenticated HTTP POST or PUT request to the rekey cancellation endpoint (e.g., PUT /v1/sys/rekey/cancel) without providing any credentials. OpenBao accepts the request due to missing authentication validation and cancels any in-progress root key rekey or recovery key rekey operation. This forces administrators to restart the entire rekey process, potentially delaying critical key rotation or recovery procedures. If multiple cancellation requests are sent in rapid succession, the attacker creates a denial-of-service condition by repeatedly disrupting administrative workflows. The attack is trivial to execute: no special tools beyond curl/HTTP client needed, no authentication bypass required, no user interaction needed. The impact is amplified in environments where key rotation is time-sensitive (e.g., compliance-required rotations) or where the vault is in recovery mode. No known public POC has been reported, but the simplicity of the exploit (unauthenticated endpoint) means any attacker can independently discover and exploit it.