Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Low | 2.1 | CVE-2026-115369 |
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled
openbaoopenbao
|
NVD | |||
|
CVE-2026-115369OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled
Executive summaryOpenBao versions from 2.5.0 before 2.6.2 do not fully enforce a certificate restriction on IP addresses taken from certificate signing requests when a PKI role has use_csr_sans enabled. The advisory rates the issue Low severity and recommends upgrading to OpenBao 2.6.2, which contains the patch. Technical summaryThe flaw is a failure to enforce the allowed_ip_sans_cidr restriction on IP SANs taken from a CSR on the pki/sign/<role> path when use_csr_sans is true, which the advisory says is the default. An authenticated caller with sign permission on a CIDR-restricted role could obtain a CA-backed certificate containing an out-of-range IP SAN, while the same IP is rejected through pki/issue/<role> with ip_sans. The advisory gives affected versions as 2.5.0 before 2.6.2 (listed as less than 2.6.2 in the affected versions field), patched version 2.6.2, and a CVSS v4 base vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. No CWE, no known CVE identifier, and no workaround are stated, and no exploitation in the wild or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-g892-p242-8g86 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.0 | CVE-2026-115366 |
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because...
openbaoopenbao
|
NVD | |||
|
CVE-2026-115366OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because...
Executive summaryOpenBao, an open-source secrets management system, has an authorization flaw affecting versions from 2.3.0 before 2.6.3. A tenant token with sufficient privileges in a child namespace could change plugin registrations, which the advisory rates as Low severity. The vendor recommends upgrading to 2.6.3 or 2.7.0, or restricting plugin catalog write and delete permissions for tenants. Technical summaryThe flaw is classified as CWE-863 (Incorrect Authorization) in the plugin registration APIs under /v1/sys/plugins/catalog/*, which did not restrict update requests to the root namespace. An attacker needs a sufficiently privileged token in a child namespace, and the CVSS v4 vector given is AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, with the advisory's stated severity listed as Low and a score of 2.0. The advisory says plugin execution requires a valid command file in the host plugin directory and a matching sha256sum, so impact is described as mainly DoS-like, such as removing or creating invalid registrations. Fixed versions are 2.6.3 and 2.7.0, and the advisory says the affected range is <2.6.3. Workarounds are to remove write and delete capabilities on sys/plugins/catalog/* from tenants or to not configure a plugin_directory. No CVE ID is assigned in the advisory ('No known CVE'), and the advisory does not state whether exploitation in the wild has occurred or give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-cg72-x35g-xfp8 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.5 | CVE-2026-115365 |
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces...
openbaoopenbao
|
NVD | |||
|
CVE-2026-115365OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces...
Executive summaryOpenBao versions from 2.3.0 before 2.6.3 contain an authorization flaw in their access control policy cache that lets a token use policies from other namespaces, including the root namespace. The advisory rates the severity as High with a CVSS v4 base score of 7.7 and states that the issue is patched in OpenBao 2.7.0 and 2.6.3. Defenders should upgrade to a patched release. Technical summaryThe flaw is an incorrect authorization issue (CWE-863) with a path traversal weakness (CWE-24) in the ACL policy cache, where tokens carrying specially crafted policy names can reference policies from arbitrary namespaces. Exploitation is over the network with low attack complexity and requires low privileges and no user interaction, and the referenced policies must be in the in-memory LRU policy cache at both token creation and use time. The affected range is stated as <2.6.3 and the patched versions are 2.6.3 and 2.7.0. The advisory gives a workaround of setting disable_cache = true in the server configuration, with a warning about significant performance impact. No CVE ID is listed (it says 'No known CVE'), and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-mjch-vcw3-hhmf Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.1 | CVE-2026-115364 |
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header
openbaoopenbao, openbao Agent and Proxy services
|
NVD | |||
|
CVE-2026-115364OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header
Executive summaryOpenBao, an open-source secrets management tool, has a flaw in its Agent and Proxy services that lets an attacker stop those services without supplying the required header. The advisory rates the severity as Low, with a CVSS v4 base score shown as 2.1 out of 10. The vendor recommends upgrading to OpenBao 2.6.3 or 2.7.0, which contain the fix. Technical summaryThe flaw is a missing authorization check on the /agent/v1/quit and /proxy/v1/quit endpoints, which allow an attacker to stop the Agent and Proxy services even when require_request_header is set to true and the X-Vault-Header is omitted. The advisory describes the attack vector as network, attack complexity as low, and privileges required as high, with no user interaction needed and only availability impact. The cache-clear endpoints are also affected but the advisory says they have no material security impact. Affected versions are stated as before 2.6.3, and patched versions are 2.6.3 and 2.7.0. No workaround is stated, and no detection guidance is stated. The advisory states no known CVE and no CWE, and does not state whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-8gmq-wv9h-fcwp Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.1 | CVE-2026-115363 |
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the...
openbaoopenbao
|
NVD | |||
|
CVE-2026-115363OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the...
Executive summaryOpenBao, an open-source secrets management tool, has an information disclosure flaw that can expose a sensitive ACME External Account Binding key to users who call a specific configuration endpoint. The advisory rates it Low severity, and the vendor recommends upgrading to OpenBao 2.6.4 or 2.7.1, depending on the release line in use. Technical summaryThe flaw is an information disclosure issue in which the tls_acme_eab_mac_key value is returned by the sys/config/state/sanitized endpoint when External Account Bindings with ACME are used on TLS-enabled listeners. The advisory gives the CVSS v4 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N with a score of 2.1, which requires network access and high privileges. Affected versions are listed as before 2.6.4 and before 2.7.1, with 2.6.4 and 2.7.1 as the patched versions. The advisory does not state any workarounds, and it gives no detection guidance or information on exploitation in the wild. No CVE ID is assigned in the advisory, and no CWEs are listed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-3237-j65r-m5rp Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.1 | CVE-2026-115362 |
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy...
openbaoopenbao
|
NVD | |||
|
CVE-2026-115362OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy...
Executive summaryOpenBao, an open-source secrets management system, has a flaw in its AppRole authentication method that lets expired Secret IDs still be used to log in until the periodic cleanup removes them. The advisory rates it Low, with a CVSS v4 base score of 2.1 out of 10. The vendor recommends upgrading to OpenBao 2.6.4 or 2.7.1, which are the patched versions. Technical summaryThe flaw is a failure to check Secret ID expiration at use, which is a logic or authorization check weakness; no CWE is listed. Exploitation requires network access with high attack complexity and high privileges, and the impact is limited to low integrity. Affected versions are stated as before 2.6.4 and 2.7.x before 2.7.1, with patched versions 2.6.4 and 2.7.1. The advisory states that expired Secret IDs remain usable until the periodic tidy process, which runs once every minute, removes them. No workarounds are stated, and no detection guidance is stated. The advisory also states that no CVE ID is known, and it does not state whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-7m59-mp95-w6ph Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.1 | CVE-2026-115361 |
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants
openbaoopenbao
|
NVD | |||
|
CVE-2026-115361OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants
Executive summaryA flaw in OpenBao, an open-source secrets management tool, can cause some explicit deny rules in access policies to be silently ignored when wildcard grants are present, allowing limited access beyond what was intended. The advisory rates it Low, with a CVSS v4 base score of 2.1 out of 10. The vendor recommends upgrading to OpenBao v2.6.3 or v2.7.0, which contain the fix. Technical summaryThe weakness is an access control bypass in policy evaluation: when a policy grants access through a global explicit wildcard and includes a narrow denial based on a forbidden identity metadata template, the denial is silently dropped. The advisory says it is also reachable where wildcard templating is not restricted, but less likely. Exploitation requires network access, high privileges, and high attack complexity and attack requirements, with user interaction not required, and the advisory states identity metadata is usually set by a trusted identity provider rather than an attacker. Affected versions are listed as before 2.6.3, and patched versions are 2.6.3 and 2.7.0. No workaround is stated, and no detection guidance, CVE ID, or CWE is given, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-hr5j-3j78-4vh2 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-115360 |
OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao
openbaoopenbao
|
NVD | |||
|
CVE-2026-115360OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao
Executive summaryOpenBao, an open source secrets management product, contains an open redirect flaw in the OIDC identity provider of its web user interface that affects users who are not logged in to OpenBao. The advisory rates it as moderate severity, with a CVSS v3 base score of 4.7. The vendor recommends upgrading to OpenBao 2.6.3 or 2.7.0, or disabling the UI by setting ui = false. Technical summaryThe flaw is an open redirect in the OpenBao UI's OIDC identity provider, classified as moderate with a CVSS score of 4.7 and vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, which requires user interaction. Affected versions are stated as less than 2.6.3. Patched versions are 2.6.3 and 2.7.0. The advisory says the UI is not enabled by default and recommends setting ui = false as a workaround. No CVE ID or CWE is listed, and the advisory does not state whether the flaw is exploited in the wild. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-2cjw-94fw-wqjx Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.3 | CVE-2026-115359 |
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded...
openbaoopenbao
|
NVD | |||
|
CVE-2026-115359OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded...
Executive summaryOpenBao, an open-source secrets management system, has a flaw that lets valid callers bypass role-based rate limit quotas when requests use form-encoded bodies or forwarded certificates. The advisory rates it Moderate with a CVSS overall score of 6.3, and the vendor recommends upgrading to OpenBao 2.7.1 or 2.6.4. Technical summaryThe flaw is in the rate limit quota subsystem, where role resolution fails for requests with form-encoded bodies or forwarded certificates, so role-scoped quota rules are not enforced. The advisory states the attack vector is network, attack complexity is low, attack requirements are present, and no privileges or user interaction are required, with a CVSS v4 vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Affected versions are stated as before 2.6.4 and 2.7.x before 2.7.1, and patched versions are 2.6.4 and 2.7.1. The advisory does not state any workaround, detection guidance, or exploitation in the wild, and it lists no CVE ID or CWE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-5v22-543h-wg96 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.0 | CVE-2026-115358 |
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters
openbaoopenbao, openbao SDK plugins, openbao github.com/openbao/openbao/sdk/v2, openbao github.com/openbao/openbao/v2
|
NVD | |||
|
CVE-2026-115358OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters
Executive summaryOpenBao versions before 2.6.3 can leak sensitive data into audit logs when a request with malformed plugin parameters is sent to a plugin. The advisory rates the issue Low severity and recommends upgrading to patched versions 2.6.3 or 2.7.0 for OpenBao and 2.6.3 or 2.7.1 for the SDK. Technical summaryThe flaw is an information disclosure issue in which malformed data in fields of type TypeKVPair or TypeHeader causes an error that is written to the audit log, exposing sensitive information. The attacker must be able to send requests to a plugin and holds high privileges according to the CVSS vector (AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 2.0). Affected Go modules are github.com/openbao/openbao/sdk/v2 before 2.6.3 and github.com/openbao/openbao/v2 before 2.6.3; patched versions are 2.6.3 and 2.7.1 for the SDK and 2.6.3 and 2.7.0 for the main module. No workaround is stated. The advisory does not give detection guidance beyond noting the error resembles GHSA-8f5r-8cmq-7fmq, and no CVE ID or CWE is assigned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-8xxq-mq9m-xmhw Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affectsopenbaoopenbaoopenbao SDK pluginsopenbao github.com/openbao/openbao/sdk/v2openbao github.com/openbao/openbao/v2
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.1 | CVE-2026-115357 |
OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints...
openbaoopenbao
|
NVD | |||
|
CVE-2026-115357OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints...
Executive summaryOpenBao versions before 2.6.4 and 2.7.x before 2.7.1 can fail to write audit log entries for responses from certain root token generation and rekey endpoints. The advisory rates the issue Low severity with a CVSS v4 base score of 2.1, and the vendor recommends upgrading to 2.6.4 or 2.7.1 and keeping the affected endpoints disabled. Technical summaryThe flaw is improper audit logging: response entries are not recorded for the sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints under certain conditions, though the request entry is still logged. The advisory says the attack vector is network, with low attack complexity, high privileges required, no user interaction, and a CVSS v4 vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Since OpenBao 2.5.3 these endpoints are disabled by default unless disable_unauthed_rekey_endpoints or disable_unauthed_generate_root_endpoints is set to false. Affected versions are listed as less than 2.7.1 and less than 2.6.4, with patched versions 2.7.1 and 2.6.4. The workaround is to keep both configuration options set to true, and the advisory does not state any detection guidance. No CVE ID or CWE is listed in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-q74w-hv5x-6hxf Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-115356 |
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to...
openbaoopenbao
|
NVD | |||
|
CVE-2026-115356OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to...
Executive summaryOpenBao, an open-source secrets management product, has a flaw in how it renews tokens issued through its Kubernetes Auth method. The advisory says an attacker can keep access after the related service account has been deleted, and rates the issue Moderate with a CVSS v4 base score of 5.3. Technical summaryThe flaw is an authorization check that is missing during token renewal in the Kubernetes Auth method, which means the original service account token is not re-validated. The advisory describes a network-reachable attack with low attack complexity that requires low privileges and no user interaction, with low confidentiality and integrity impact on the vulnerable system. Affected versions are stated as before 2.6.4 and 2.7.x before 2.7.1, with patched versions 2.6.4 and 2.7.1. The advisory does not state any workaround, and it provides no detection guidance. It also gives no CWE and no CVE ID, and it does not say whether the flaw has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openbao/openbao/security/adv…/GHSA-gf3j-hm38-jhh5 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||