Openbao vulnerabilities
44 CVEs and advisories name Openbao as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115369OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
- CVE-2026-115366OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs
- CVE-2026-115365OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
- CVE-2026-115364OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints
- CVE-2026-115363OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
- CVE-2026-115362OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass
- CVE-2026-115361OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
- CVE-2026-115360OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI
- CVE-2026-115359OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
- CVE-2026-115358OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters
- CVE-2026-115357OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses
- CVE-2026-115356OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
- CVE-2026-63132OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
- CVE-2026-63131OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)
- CVE-2026-77285OpenBao Agent Writes Secrets to Stdout
- CVE-2026-71543OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
- CVE-2026-55770OpenBao: LDAPi ldaputil (wrong escape func)
- CVE-2026-55776OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
- CVE-2026-55774OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808
- CVE-2026-55775OpenBao's System Backend allows Unauthorized Management of the containing Namespace
- CVE-2026-45808OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
- CVE-2026-46405OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
- CVE-2026-46358OpenBao's Inline Auth Incorrectly Redacted Headers
- CVE-2026-42186OpenBao's Namespace Deletion May Not Delete Data Properly
- CVE-2026-40264OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
- CVE-2026-39396OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)
- CVE-2026-39388OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate
- CVE-2026-39946OpenBao allows SQL Injection in PostgreSQL database secrets engine
- CVE-2026-33758OpenBao has Reflected XSS in its OIDC authentication error message
- CVE-2026-33757OpenBao lacks user confirmation for OIDC direct callback mode