BIT-openbao-2024-9180

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2024-9180.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-openbao-2024-9180

Aliases

Published

2026-07-27T05:48:45.717Z

Modified

2026-07-27T09:11:28.506959585Z

Summary

Vault Operators in Root Namespace May Elevate Their Privileges

Details

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

Database specific

{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:openbao:openbao:*:*:*:*:*:go:*:*"
    ]
}

References

Affected packages

Bitnami / openbao

Package

Name: openbao
Purl: pkg:bitnami/openbao

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.3

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2024-9180.json"