OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-59048 · Microsoft / collected KEV context

EUVD-2025-35697

GHSA-jp7h-4f3c-9rc7

GO-2025-4067

cve-program · CVE-2025-59048

• https://github.com/openbao/openbao-plugins/security/advisories/GHSA-jp7h-4f3c-9rc7
• https://github.com/openbao/openbao-plugins/commit/2a77af36834746ca6d3ac9bd1049154c84b3efae

euvd · EUVD-2025-35697

• https://github.com/openbao/openbao-plugins/security/advisories/GHSA-jp7h-4f3c-9rc7
• https://github.com/openbao/openbao-plugins/commit/2a77af36834746ca6d3ac9bd1049154c84b3efae

nvd · CVE-2025-59048

• https://github.com/openbao/openbao-plugins/commit/2a77af36834746ca6d3ac9bd1049154c84b3efae
• https://github.com/openbao/openbao-plugins/security/advisories/GHSA-jp7h-4f3c-9rc7

osv · GHSA-jp7h-4f3c-9rc7

• https://github.com/openbao/openbao-plugins/security/advisories/GHSA-jp7h-4f3c-9rc7
• https://github.com/openbao/openbao-plugins/commit/2a77af36834746ca6d3ac9bd1049154c84b3efae
• https://github.com/openbao/openbao-plugins

osv · GO-2025-4067

• https://github.com/openbao/openbao-plugins/security/advisories/GHSA-jp7h-4f3c-9rc7
• https://github.com/openbao/openbao-plugins/commit/2a77af36834746ca6d3ac9bd1049154c84b3efae

No related operational record is retained in the current change model.