Cloudanix VulnDB

CVE-2025-59048

High · 8.1

OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method

CVSS

8.1

EPSS

0.3%

Published

Oct 23, 2025

CISA due date

—

The record

This is a cross-account impersonation vulnerability in the `auth-aws` plugin. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the **same name** in a trusted account, leading to unauthorized access. This impacts all users of the `auth-aws` plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts. The core of the vulnerability is a flawed caching mechanism that fails to validate the AWS Account ID during authentication. While the use of wildcards in a `bound_iam_principal_arn configuration` significantly increases the attack surface, **wildcards are not a prerequisite for exploitation**. The vulnerability can be exploited with specific ARN bindings if a role name collision occurs. Successful exploitation can lead to unauthorized access to secrets, data exfiltration, and privilege escalation. Given that the only prerequisite is a duplicate role name, the severity is considered **high**.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/openbao/openbao-plugins 0 No fix
Go github.com/openbao/openbao-plugins 0 0.1.1
openSUSE:Tumbleweed govulncheck-vulndb 0 0.0.20251105T184115-1.1

Related vulnerabilities