Priority LOW 10
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled.
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.00134 · Published 2026-10-22 · Fixed in 2.6.2 CWE-863
Priority LOW 10
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the roo…
CVSS 4.0LOW 2.0· Network · Low privileges · User interaction · EPSS 0.00179 · Published 2026-10-22 · Fixed in 2.6.3 CWE-863
Priority LOW 35
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names.
CVSS 4.0HIGH 7.5· Network · High privileges · No interaction · EPSS 0.00304 · Published 2026-10-22 · Fixed in 2.6.3 CWE-863
Priority LOW 11
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header.
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.00315 · Published 2026-10-22 · Fixed in 2.6.3 CWE-862
Priority LOW 10
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint.
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.00125 · Published 2026-10-22 · Fixed in 2.6.4, 2.7.1 CWE-212
Priority LOW 11
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them.
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.00197 · Published 2026-10-22 · Fixed in 2.6.4, 2.7.1 CWE-613
Priority LOW 11
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants.
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.00205 · Published 2026-10-22 · Fixed in 2.6.3 CWE-863
Priority LOW 30
OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00248 · Published 2026-10-22 · Fixed in 2.6.3 CWE-601
Priority LOW 27
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-…
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00187 · Published 2026-10-22 · Fixed in 2.6.4, 2.7.1 CWE-799
Priority LOW 10
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters.
CVSS 4.0LOW 2.0· Network · High privileges · User interaction · EPSS 0.00195 · Published 2026-10-22 · Fixed in 2.6.3, 2.7.1 CWE-532
Priority LOW 11
OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but respons…
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.0021 · Published 2026-10-22 · Fixed in 2.6.4, 2.7.1 CWE-778
Priority LOW 23
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00213 · Published 2026-10-22 · Fixed in 2.6.4, 2.7.1 CWE-613
Priority MEDIUM 43
OpenBao is an open source identity-based secrets management system.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00629 · Published 2026-09-23 · Partial fix · 2.6.0, 0.0.0-20260713141742-763625a20721 CWE-208
Priority LOW 27
OpenBao is an open source identity-based secrets management system.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00484 · Published 2026-09-23 · Fixed in 2.6.0, 0.0.0-20260713133043-f58d848c139e CWE-863
Priority LOW 12
OpenBao is an open source identity-based secrets management system.
CVSS 4.0LOW 2.4· Local · High privileges · User interaction · EPSS 0.00165 · Published 2026-09-23 · Fixed in 2.6.0, 0.0.0-20260714163218-90272575e5f5 CWE-532
Priority LOW 35
OpenBao is an open source identity-based secrets management system.
CVSS 4.0HIGH 7.5· Network · High privileges · No interaction · EPSS 0.00421 · Published 2026-09-21 · Fixed in 2.6.0, 0.0.0-20260710001938-2d4ebafec5c5 CWE-863
Priority HIGH 65
OpenBao is an open source identity-based secrets management system.
CVSS 3.1MEDIUM 6.8· Network · Low privileges · No interaction · EPSS 0.00525 · Published 2026-09-15 · Fixed in 2.5.5, 0.0.0-20260617104213-10b7825c714c CWE-90
Priority MEDIUM 62
OpenBao is an open source identity-based secrets management system.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00612 · Published 2026-09-15 · Fixed in 2.5.5, 0.0.0-20260617104123-db57c62602b2 CWE-617
Priority LOW 12
OpenBao is an open source identity-based secrets management system.
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.00562 · Published 2026-09-15 · Fixed in 2.5.5, 0.0.0-20260617103932-b20b999dd404 CWE-863
Priority LOW 13
OpenBao is an open source identity-based secrets management system.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00484 · Published 2026-09-15 · Fixed in 2.5.5, 0.0.0-20260617103935-d3c1cc64b1ae CWE-285
Priority LOW 32
OpenBao is an open source identity-based secrets management system.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00427 · Published 2026-08-07 · Fixed in 2.5.4 CWE-863
Priority LOW 31
OpenBao is an open source identity-based secrets management system.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00617 · Published 2026-08-07 · Fixed in 2.5.4 CWE-770
Priority HIGH 66
OpenBao is an open source identity-based secrets management system.
CVSS 4.0MEDIUM 5.4· Local · High privileges · User interaction · EPSS 0.0021 · Published 2026-08-07 · Fixed in 2.5.4 CWE-532
Priority LOW 12
OpenBao is an open source identity-based secrets management system.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00248 · Published 2026-05-14 · Fixed in 2.5.3, 0.0.0-20260420173541-6d2e0506e2b4 CWE-212
Priority LOW 11
OpenBao is an open source identity-based secrets management system.
CVSS 4.0LOW 2.0· Network · High privileges · User interaction · EPSS 0.00301 · Published 2026-04-21 · Fixed in 2.5.3, 0.0.0-20260420162526-f58111d2ca54 CWE-1259
Load more
THREATIST.IORead the docs