High, CVSS 8.1GoPublished
OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method
CVE-2025-59048 · GHSA-jp7h-4f3c-9rc7
- Affected
- Go github.com/openbao/openbao-plugins <= 0.1.0
- Fixed in
- 0.1.1· Vendor fix available
- Issue
- Impact This is a cross-account impersonation vulnerability in the auth-aws plugin. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access. This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts. The core of the vulnerability is a flawed caching mechanism that fails to validate the AWS Account ID during authentication. While the use of wildcards in a boundiamprincipalarn configuration significantly increases the attack surface, wildcards are not a prerequisite for exploitation. The vulnerability can be exploited with specific ARN bindings if a role name collision occurs. Successful exploitation can lead to unauthorized access to secrets, data exfiltration, and privilege escalation. Given that the only prerequisite is a duplicate role name, the severity is considered high.…
Recommended action: Upgrade to 0.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.