OpenBao Userpass and LDAP User Lockout Bypass

中 5.3CVE-2025-54998 · BIT-openbao-2025-54998 · GHSA-j3xv-7fxp-gfhx · 09/08/2025 公開 · 17/06/2026 更新

要点

CVE-2025-54998 は github.com/openbao/openbao, openbao (openbao) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.23%（全脆弱性の 14.3% より高い）。
対処：2.3.2, 0.0.0-20250807212521-c52795c1ef74 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/openbao/openbao Go	`≥ 0.1.0, < 2.3.2≥ 0.1.0< 0.0.0-20250807212521-c52795c1ef74`	`2.3.20.0.0-20250807212521-c52795c1ef74`
openbao openbao	`< 2.3.2`	`2.3.2`

概要

Impact

Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions.

Patches

OpenBao v2.3.2 will patch this issue.

Workarounds

Existing users may apply rate-limiting quotas on the authentication endpoints: https://openbao.org/api-docs/system/rate-limit-quotas/

References

This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:

NVD の説明

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. This is fixed in version 2.3.2. To work around this issue, existing users may apply rate-limiting quotas on the authentication endpoints:, see https://openbao.org/api-docs/system/rate-limit-quotas/.