How severe is CVE-2025-59048?

CVE-2025-59048 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2025-59048 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-59048?

CVE-2025-59048 affects Openbao Aws Plugin. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-59048?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-59048 have an EU (EUVD) identifier?

Yes. CVE-2025-59048 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-35697.

When was CVE-2025-59048 published?

CVE-2025-59048 was published on 2025-10-23 and last updated on 2026-06-17.

CVE-2025-59048

CVE-2025-59048 is a high-severity vulnerability in Openbao Aws Plugin with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-694.

Key facts

Severity: High (CVSS 3.x base score 8.1)
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-35697
Weakness: CWE-694
Affected product: Openbao Aws Plugin
Published: 2025-10-23
Last modified: 2026-06-17

Description

OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation in the AWS auth method. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access. This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts. This vulnerability has been patched in version 0.1.1 of the auth-aws plugin. A workaround for this issue involves guaranteeing that IAM role names are unique across all AWS accounts that could potentially interact with your OpenBao environment, and to audit for any duplicate IAM roles.

Frequently asked questions

What is CVE-2025-59048?: OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation in the AWS auth method. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access. This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts. This vulnerability has been patched in version 0.1.1 of the auth-aws plugin. A workaround for this issue involves guaranteeing that IAM role names are unique across all AWS accounts that could potentially interact with your OpenBao environment, and to audit for any duplicate IAM roles.
How severe is CVE-2025-59048?: CVE-2025-59048 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2025-59048 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-59048?: CVE-2025-59048 affects Openbao Aws Plugin. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-59048?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-59048 have an EU (EUVD) identifier?: Yes. CVE-2025-59048 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-35697.
When was CVE-2025-59048 published?: CVE-2025-59048 was published on 2025-10-23 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:openbao:aws_plugin:*:*:*:*:*:*:*:*

Other CWE-694 vulnerabilities

CVE-2025-13609 — High (CVSS 8.2): A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using…
CVE-2023-20100 — Medium (CVSS 6.8): A vulnerability in the access point (AP) joining process of the Control and Provisioning of Wireless Access Points…
CVE-2026-5794 — Medium (CVSS 4.9): A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by…
CVE-2024-41146 — Medium (CVSS 4.6): Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms…
CVE-2021-3436 — Medium (CVSS 4.3): BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is…

Browse all CWE-694 vulnerabilities →