What is the CVSS score of CVE-2025-59048?

CVE-2025-59048 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of OpenBao AWS Plugin are affected by CVE-2025-59048?

OpenBao's AWS authentication plugin (auth-aws, versions through 0.1.0) can grant an attacker access to secrets and privileged data by impersonating a trusted IAM role when role names collide across…. A patch is available.

How to fix or mitigate CVE-2025-59048?

Within 24 hours, inventory every OpenBao deployment using the auth-aws plugin to determine whether auth-aws is installed at version 0.1.0 or earlier and whether the environment spans multiple AWS accounts with overlapping IAM role names; for any confirmed multi-account deployment, treat the affected auth-aws mounts as untrusted, rotate or revoke credentials issued through them, and review audit logs for role-name collisions or authentication events originating from unexpected AWS account IDs. Within 7 days, upgrade the auth-aws plugin beyond version 0.1.0 to the fixed release identified in the vendor's advisory, validate the upgrade in a non-production environment first, and confirm the plugin no longer caches credentials without the AWS Account ID; where an immediate upgrade is not possible, restrict which accounts and role names can authenticate and enforce globally unique role names across accounts. Within 30 days, complete the rollout to all environments, make IAM role names globally unique across AWS accounts as a standing control, add monitoring and alerting for cross-account authentication anomalies, and re-verify that all secret paths previously reachable through the vulnerable plugin are properly access-controlled. Note that per the vendor's current advisory the patched version is available, while the low EPSS score (0.27%) and the absence of identified public exploit code indicate limited active threat activity at this time.

OpenBao AWS Plugin CVE-2025-59048

HIGH

Use of Multiple Resources with Duplicate Identifier (CWE-694)

2025-10-23 security-advisories@github.com

Authentication Bypass Openbao Aws Plugin

8.1

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network auth endpoint with attacker-held IAM role gives AV:N/PR:L; AC:H because a trusted/untrusted role-name collision must exist outside attacker control; C:H/I:H from secret access, A:N.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Openbao added

Analysis Generated

Oct 08, 2026 - 12:18 vuln.today

CVE Published

Oct 23, 2025 - 16:16 cve.org

HIGH 8.1

DescriptionCVE.org

OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation in the AWS auth method. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access. This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts. This vulnerability has been patched in version 0.1.1 of the auth-aws plugin. A workaround for this issue involves guaranteeing that IAM role names are unique across all AWS accounts that could potentially interact with your OpenBao environment, and to audit for any duplicate IAM roles.

AnalysisAI

Cross-account IAM role impersonation in OpenBao's auth-aws plugin (versions up to and including 0.1.0) lets an authenticated attacker holding credentials for an IAM role in an untrusted AWS account authenticate to OpenBao by presenting a role name that collides with a trusted role in a different account, granting unauthorized access to secrets, data, and elevated privileges. The flaw is rooted in a client cache that is keyed only by AWS region and STS role and fails to incorporate the AWS Account ID, so a cached credential for one account is reused for another. Exploitation is environment-gated: it only affects multi-account AWS deployments where IAM role names are not globally unique, and a role-name collision must exist; EPSS is low (0.27%, 17th percentile) and no public exploit code has been identified at time of analysis.

Technical ContextAI

The auth-aws plugin is a Go-based OpenBao/Vault auth method that authenticates principals by calling AWS STS AssumeRole and validating the resulting identity (IAM principal ARN / account ID) against configured bindings. CWE-694 (Use of Multiple Resources with Duplicate Identifier) describes the root cause precisely: the backend maintains in-memory client caches (EC2ClientsMap and IAMClientsMap) originally keyed on region and stsRole alone, omitting the AWS account ID. Because role names are frequently reused across AWS accounts, the cache could return a client/credential scoped to one account when servicing a request for a same-named role in another, and stsRoleForAccount did not reject resolution when no per-account STS configuration existed and the account differed from the configured default. The patch restructures both maps into a three-level key of region → accountID → stsRole, adds an explicit error when no STS config exists for a non-default account, and adds a regression test (TestClientCache) asserting that IAM clients for different accounts are isolated in the cache. The plugin generates AWS credentials derived from IAM policies, which is why a bypass translates into credential exposure and privilege escalation rather than merely an authentication nuisance.

RemediationAI

Vendor-released patch: upgrade the auth-aws plugin to version 0.1.1 (fixed in 0.1.1; vulnerable <= 0.1.0), available from the advisory at https://github.com/openbao/openbao-plugins/security/advisories/GHSA-jp7h-4f3c-9rc7 and the fix commit at https://github.com/openbao/openbao-plugins/commit/2a77af36834746ca6d3ac9bd1049154c84b3efae, which keys the EC2/IAM client caches by region, account ID, and STS role and rejects requests for non-default accounts lacking STS configuration. If an immediate upgrade is not possible, the primary and most effective workaround is to guarantee that IAM role names are unique across every AWS account that could interact with OpenBao: audit the AWS organization for duplicate names and rename them using account-specific identifiers, since removing wildcards from bound_iam_principal_arn is a good hardening step but will NOT mitigate the flaw while duplicate names persist (trade-off: renaming roles can break existing policy attachments or trust relationships and requires coordinated change management). Additionally, restrict each OpenBao AWS auth role to specific bound_iam_principal_arn values and tighten trust policies on roles assumed by the plugin, accepting that these reduce but do not eliminate exposure in collision scenarios. Environments that are single-account, or that already enforce globally unique IAM role names, are not affected and need not treat this as urgent.