cyfenced.com →

[ CVE-2026-77285 · Published 23 Sep 2026 ]

OpenBao Agent Writes Secrets to Stdout

CVSS 2.4 EPSS <1%Fix available

[ Description ]Official description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

[ Fixes ]Fixes and patches

[ Packages ]Affected open-source packages

  • github.com/openbao/openbao goAffected < 0.0.0-20260714163218-90272575e5f5 · fixed in 0.0.0-20260714163218-90272575e5f5 · GHSA-444v-8vxr-p36h
  • github.com/openbao/openbao goAffected >= 0.1.0, <= 1.1.5 · GHSA-444v-8vxr-p36h

[ References ]References