BIT-OPENBAO-2026-115356 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

PT-2026-132448

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

CVE-2026-115356

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

CVE-2026-115356

The OpenBao secret management system is vulnerable to a token renewal issue in versions before 2.6.4 and 2.7.x before 2.7.1 . The Kubernetes Auth method fails to verify if the original service account token remains valid during the renewal process. This allows an authenticated attacker to continu...

CVE-2026-115356 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

CVE-2026-115356 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

EUVD-2026-108426

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

CVE-2026-115356

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

CVE-2026-115356 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

PT-2026-121536

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1 Description When renewing a token issued by the Kubernetes Auth method, the system fails to verify if the service account token used for the initial authentication remains...

OpenBao session mechanism vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a session mechanism vulnerability. This vulnerability arises because, when renewing tokens issued by the Kubernetes Auth method, it fails to verify whether the originally used service account token remains valid. As a resul...

PT-2026-77167

Name of the Vulnerable Software and Affected Versions AAP Controller affected versions not specified Description A flaw exists in the HashiCorp Vault credential plugin of the AAP Controller. When a HashiCorp Vault Secret Lookup credential using kubernetes role authentication is tested, the...

PT-2026-71084

Name of the Vulnerable Software and Affected Versions Prowler versions prior to 5.36.0 Description The Kubernetes provider connection test fails to properly validate kubeconfig content containing a legacy GCP auth-provider. Specifically, the kubeconfig contains exec auth function in...

Security update for golang-github-docker-libnetwork

This update for golang-github-docker-libnetwork fixes the following issue CVE-2026-2808: github.com/hashicorp/consul: unvalidated user-supplied file paths can lead to arbitrary file reads through the Vault Kubernetes authentication provider bsc1259566. Patch Instructions: To install this SUSE...