Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: openbao fixed in 2.4.1-r0
AnalysisAI
OpenBao, an open-source secrets management platform forked from HashiCorp Vault, received a security fix in Alpine Linux package version 2.4.1-r0 addressing CVE-2025-59043. The vulnerability details, affected component, and exploitability conditions are not publicly disclosed in available intelligence sources at time of analysis. EPSS scoring places this at the 37th percentile (0.16% exploitation probability), suggesting low observed exploitation pressure, and no public exploit code or CISA KEV listing has been identified.
Technical ContextAI
OpenBao is an open-source fork of HashiCorp Vault maintained under the OpenBao project, providing secrets management, identity-based access, and dynamic credentials for infrastructure and applications. The affected package is distributed via Alpine Linux's package repository as 'openbao', with the patched version identified as 2.4.1-r0 in Alpine's packaging scheme (upstream version 2.4.1, Alpine revision 0). No CWE root cause classification is available in the provided intelligence, and no CPE strings or CVSS vector have been published for this CVE, making technical root cause analysis impossible from current data. The fix is confirmed only at the Alpine Linux packaging level.
Affected ProductsAI
OpenBao as packaged for Alpine Linux is confirmed affected prior to version 2.4.1-r0. The fix is contained in the Alpine Linux package openbao 2.4.1-r0. Specific upstream OpenBao version ranges below 2.4.1 are inferred as affected, but this has not been independently confirmed via an upstream OpenBao security advisory. Whether non-Alpine distributions of OpenBao (e.g., Docker images, direct binary releases, other Linux distributions) are affected by the same underlying vulnerability is unknown from available data. No CPE strings were provided to further scope affected deployments.
RemediationAI
Upgrade the Alpine Linux openbao package to version 2.4.1-r0 or later using the standard Alpine package manager: 'apk upgrade openbao'. This is the only confirmed remediation action derivable from available data. No upstream OpenBao advisory URL was provided in the intelligence sources, so the exact upstream fix version cannot be independently cited beyond the Alpine packaging. If upgrading immediately is not feasible and if OpenBao is network-exposed, consider restricting access to the OpenBao API listener (default port 8200) via firewall rules or network segmentation as a compensating control - note this may impact dependent services consuming secrets. Given that OpenBao manages secrets and credentials, any compromise has high downstream impact, making patching the strongly preferred remediation path. No workarounds specific to this vulnerability can be recommended without knowledge of the affected component.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today