Priority HIGH 76
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00451 · Published 2024-03-04 · Partial fix · 1.16.0, 1.15.5 +1 CWE-295
Priority MEDIUM 62
OpenBao is an open source identity-based secrets management system.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00218 · Published 2026-04-21 · Fixed in 2.5.3, 0.0.0-20260420180337-2b2a901aa9f7 CWE-400
Priority MEDIUM 43
OpenBao is an open source identity-based secrets management system.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00418 · Published 2026-03-27 · Fixed in 2.5.2, 0.0.0-20260325142553-e32103951925 CWE-384
Priority MEDIUM 42
OpenBao is an open source identity-based secrets management system.
CVSS 4.0CRITICAL 9.4· Network · No auth · User interaction · EPSS 0.00298 · Published 2026-03-27 · Fixed in 2.5.2, 0.0.0-20260325133417-6e2b2dd84f0e CWE-116
Priority MEDIUM 42
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00431 · Published 2025-08-09 · Fixed in 2.3.2, 0.0.0-20250806194004-a14053c9679d CWE-94
Priority MEDIUM 40
OpenBao is an open source identity-based secrets management system.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00688 · Published 2025-10-17 · Fixed in 2.4.1 CWE-400
Priority MEDIUM 40
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00269 · Published 2024-09-26 · Partial fix · 1.17.6, 0.0.0-20241003222810-d5b4e9224698 CWE-732
Priority LOW 39
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint .
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00476 · Published 2024-10-31 · Partial fix · 1.18.1, 2.0.3 CWE-636
Priority LOW 37
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00396 · Published 2025-06-25 · Fixed in 2.3.0, 0.0.0-20250625150133-fe75468822a2 CWE-20
Priority LOW 35
OpenBao is an open source identity-based secrets management system.
CVSS 4.0HIGH 7.5· Network · High privileges · No interaction · EPSS 0.0039 · Published 2025-11-25 · Fixed in 2.4.4 CWE-266
Priority LOW 34
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00353 · Published 2025-08-09 · Fixed in 2.3.2, 0.0.0-20250806193240-9b0b5d4f345f CWE-269
Priority LOW 34
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00525 · Published 2024-10-10 · Partial fix · 1.18.0, 2.0.3 CWE-266
Priority LOW 30
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00233 · Published 2025-08-09 · Fixed in 2.3.2, 0.0.0-20250807212521-c52795c1ef74 CWE-307
Priority LOW 29
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operati…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00457 · Published 2025-05-02 · Partial fix · 1.19.2, 1.19.3 CWE-209
Priority LOW 28
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00244 · Published 2025-08-09 · Fixed in 2.3.2, 0.0.0-20250807212521-c52795c1ef74 CWE-156
Priority LOW 28
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2025-08-09 · Fixed in 2.3.2, 0.0.0-20250806193153-183891f8d535 CWE-156
Priority LOW 26
OpenBao is an open source identity-based secrets management system.
CVSS 4.0MEDIUM 5.7· Network · High privileges · User interaction · EPSS 0.00331 · Published 2025-10-22 · Fixed in 2.4.2, 0.0.0-20251022165510-cc2c476bac66 CWE-532
Priority LOW 25
OpenBao is an open source identity-based secrets management system.
CVSS 4.0MEDIUM 5.7· Network · High privileges · User interaction · EPSS 0.00316 · Published 2025-10-22 · Fixed in 2.4.2, 0.0.0-20251022165510-cc2c476bac66 CWE-532
Priority LOW 25
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00268 · Published 2025-08-09 · Fixed in 2.3.2, 0.0.0-20250807113757-8340a6918f6c CWE-307
Priority LOW 21
OpenBao is an open source identity-based secrets management system.
CVSS 4.0MEDIUM 4.6· Network · High privileges · No interaction · EPSS 0.00235 · Published 2026-04-21 · Fixed in 2.5.3, 0.0.0-20260420155735-b596b0882620 CWE-89
Priority LOW 21
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVSS 3.1MEDIUM 4.5· Network · High privileges · User interaction · EPSS 0.00338 · Published 2025-06-25 · Fixed in 2.3.0 CWE-532
Priority LOW 17
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00213 · Published 2025-08-09 · Fixed in 2.3.2, 0.0.0-20250806193356-4d9b5d3d6486 CWE-203
Priority LOW 12
OpenBao is an open source identity-based secrets management system.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00248 · Published 2026-05-14 · Fixed in 2.5.3, 0.0.0-20260420173541-6d2e0506e2b4 CWE-212
Priority LOW 11
OpenBao is an open source identity-based secrets management system.
CVSS 4.0LOW 2.0· Network · High privileges · User interaction · EPSS 0.00301 · Published 2026-04-21 · Fixed in 2.5.3, 0.0.0-20260420162526-f58111d2ca54 CWE-1259
Priority LOW 10
OpenBao is an open source identity-based secrets management system.
CVSS 4.0LOW 2.0· Network · High privileges · User interaction · EPSS 0.00101 · Published 2026-04-21 · Fixed in 2.5.3, 0.0.0-20260420160924-abe84e1af4c3 CWE-295
THREATIST.IORead the docs