Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: openbao 2.6.3 Clear all filters
TI-2026-79453 CVE-2026-115366 · GHSA-9c89-7cx9-85p4

Missing root namespace enforcement in OpenBao plugin catalog APIs

Priority LOW 10

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the roo…

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00179 Published 2026-10-22 Fixed in 2.6.3 CWE-863
TI-2026-79452 CVE-2026-115365 · GHSA-w7x3-3wf8-3w6w

Incorrect authorization in OpenBao policy cache allows cross-namespace access

Priority LOW 35

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00304 Published 2026-10-22 Fixed in 2.6.3 CWE-863
TI-2026-79451 CVE-2026-115364 · GHSA-rw7f-qpfc-j3vm

Missing authorization in OpenBao lets attackers stop Agent and Proxy

Priority LOW 11

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00315 Published 2026-10-22 Fixed in 2.6.3 CWE-862
TI-2026-79448 CVE-2026-115361 · GHSA-fwx5-v4ww-26c8

ACL bypass in OpenBao drops templated deny rules

Priority LOW 11

OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00205 Published 2026-10-22 Fixed in 2.6.3 CWE-863
TI-2026-79447 CVE-2026-115360 · GHSA-x22g-c4g9-m3q8

Open redirect in OpenBao OIDC identity provider UI

Priority LOW 30

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00248 Published 2026-10-22 Fixed in 2.6.3 CWE-601
TI-2026-79445 CVE-2026-115358 · GHSA-h7rj-f8m2-hv6h

Sensitive data leak in OpenBao audit log via malformed parameters

Priority LOW 10

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters.

CVSS 4.0LOW 2.0 Network High privileges User interaction EPSS 0.00195 Published 2026-10-22 Fixed in 2.6.3, 2.7.1 CWE-532