A critical authorization flaw in the OpenBao AWS Plugin allows unauthorized cross-account IAM role impersonation, potentially granting attackers access to sensitive resources.

This is an incorrect authorization vulnerability (CWE-863) combined with duplicate identifier issues (CWE-694) where the plugin fails to enforce strict account boundaries for IAM roles. An authenticated user can leverage duplicate role names to impersonate roles across AWS accounts, leading to unauthorized access to the target environment.

The ability to impersonate IAM roles across AWS accounts poses a significant risk to organizational security, potentially leading to unauthorized data access, privilege escalation, and lateral movement within cloud infrastructure. With a CVSS score of 8.1, this high-severity vulnerability warrants immediate attention to prevent the compromise of cloud-based assets and sensitive data stored within AWS environments.

Immediate Action: Update the OpenBao AWS Plugin to version 0.1.1 or later to resolve the underlying authorization logic flaw.

Proactive Monitoring: Review AWS IAM access logs and OpenBao audit logs for suspicious authentication patterns or roles being accessed from unexpected account identifiers.

Compensating Controls: Ensure strict uniqueness of all IAM role names across all AWS accounts interacting with the OpenBao environment until the patch can be fully deployed.

Public Exploit Available: No (exploit_available unknown)

The severity of this authorization bypass necessitates immediate remediation, particularly for organizations operating in complex, multi-account AWS environments. Administrators should prioritize upgrading to version 0.1.1 immediately to eliminate the impersonation path and ensure that IAM role naming conventions are strictly enforced as a defense-in-depth measure.