Executive Summary

This vulnerability in OpenBao allows a privileged operator to escalate permissions by adding a root policy to an identity group via the identity group subsystem. Specifically, if an operator in the root namespace has access to identity/groups endpoints but lacks policy access, they can still escalate privileges. Operators with policy access could also create or modify policies to grant root-equivalent permissions through the sudo capability. This issue was fixed in version 2.4.4.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized privilege escalation, allowing an attacker or malicious operator to gain root-equivalent permissions within the OpenBao system. This could result in unauthorized access to sensitive secrets and potentially compromise the entire secrets management system's security.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenBao to version 2.4.4 or later, as this version contains the patch that fixes the privilege escalation vulnerability. Additionally, review and restrict operator access to identity/groups endpoints, especially for operators in the root namespace without policy access, to minimize risk until the upgrade is applied.

Useful 0 Not Useful 0