[ Vendor · 16 CVEs ]
openbao
CVEs affecting openbao published in the last 30 days, plus any openbao CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-115366 | 22 Oct 2026 | CVSS 2.6 | openbaoOpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin… | |
| CVE-2026-115369 | 22 Oct 2026 | CVSS 2.2 | openbaoOpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is… | |
| CVE-2026-115359 | 22 Oct 2026 | CVSS 3.7 | openbaoOpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with… | |
| CVE-2026-115360 | 22 Oct 2026 | CVSS 4.7 | openbaoOpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao… | |
| CVE-2026-115361 | 22 Oct 2026 | CVSS 4.1 | openbaoOpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates… | |
| CVE-2026-115362 | 22 Oct 2026 | CVSS 2.2 | openbaoOpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid… | |
| CVE-2026-115363 | 22 Oct 2026 | CVSS 3.3 | openbaoOpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value… | |
| CVE-2026-115364 | 22 Oct 2026 | CVSS 2.2 | openbaoOpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header… | |
| CVE-2026-115365 | 22 Oct 2026 | CVSS 6.6 | openbaoOpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies… | |
| CVE-2026-115356 | 22 Oct 2026 | CVSS 5.4 | openbaoOpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account… | |
| CVE-2026-115357 | 22 Oct 2026 | CVSS 2.2 | openbaoOpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and… | |
| CVE-2026-115358 | 22 Oct 2026 | CVSS 2.0 | openbaoOpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending… | |
| CVE-2026-77285 | 23 Sep 2026 | CVSS 2.4 | OpenBao Agent Writes Secrets to StdoutOpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from… | Fix |
| CVE-2026-63131 | 23 Sep 2026 | CVSS 6.0 | OpenBao Skips Stricter Deny Policy for LIST operationsOpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard… | Fix |
| CVE-2026-63132 | 23 Sep 2026 | CVSS 9.2 | OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackOpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared… | Fix |
| CVE-2026-71543 | 21 Sep 2026 | CVSS 7.5 | OpenBao's Templated Policies Allow Privilege Escalation via Wildcard CharactersOpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute… | Fix |