Aws Plugin
Monthly
Cross-account IAM role impersonation in OpenBao's auth-aws plugin (versions up to and including 0.1.0) lets an authenticated attacker holding credentials for an IAM role in an untrusted AWS account authenticate to OpenBao by presenting a role name that collides with a trusted role in a different account, granting unauthorized access to secrets, data, and elevated privileges. The flaw is rooted in a client cache that is keyed only by AWS region and STS role and fails to incorporate the AWS Account ID, so a cached credential for one account is reused for another. Exploitation is environment-gated: it only affects multi-account AWS deployments where IAM role names are not globally unique, and a role-name collision must exist; EPSS is low (0.27%, 17th percentile) and no public exploit code has been identified at time of analysis.
Cross-account IAM role impersonation in OpenBao's auth-aws plugin (versions up to and including 0.1.0) lets an authenticated attacker holding credentials for an IAM role in an untrusted AWS account authenticate to OpenBao by presenting a role name that collides with a trusted role in a different account, granting unauthorized access to secrets, data, and elevated privileges. The flaw is rooted in a client cache that is keyed only by AWS region and STS role and fails to incorporate the AWS Account ID, so a cached credential for one account is reused for another. Exploitation is environment-gated: it only affects multi-account AWS deployments where IAM role names are not globally unique, and a role-name collision must exist; EPSS is low (0.27%, 17th percentile) and no public exploit code has been identified at time of analysis.