[SECURITY] Fedora 43 Update: openbao-2.6.5-1.fc43

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

[SECURITY] Fedora 44 Update: openbao-2.6.5-1.fc44

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

[SECURITY] Fedora 45 Update: openbao-2.6.5-1.fc45

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

Fedora 45 : openbao (2026-fc3fbffe59)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fc3fbffe59 advisory. Update to upstream 2.6.5 which includes a number of security fixes, see https://github.com/openbao/openbao/releases/v2.6.5. Also fixes golang CVE-2026-111943...

Fedora 43 : openbao (2026-5f701776a6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5f701776a6 advisory. Update to upstream 2.6.5 which includes a number of security fixes, see https://github.com/openbao/openbao/releases/v2.6.5. Also fixes golang CVE-2026-111943...

Fedora 44 : openbao (2026-d255ce2e09)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d255ce2e09 advisory. Update to upstream 2.6.5 which includes a number of security fixes, see https://github.com/openbao/openbao/releases/v2.6.5. Also fixes golang CVE-2026-111943...

CVE-2026-115364

A flaw was found in OpenBao. This vulnerability allows a remote attacker to cause a Denial of Service DoS by shutting down Agent and Proxy services. Due to a missing authorization check, administrative termination endpoints fail to validate the presence of the required security header even when...

CVE-2026-115363

A flaw was found in OpenBao. When External Account Binding EAB is configured with the Automatic Certificate Management Environment ACME to manage certificates, the sanitized configuration endpoint fails to redact the EAB Message Authentication Code MAC key. An authenticated user with permission t...

CVE-2026-115362

A flaw was found in OpenBao. An attacker holding an expired AppRole Secret ID can authenticate to the system and gain unauthorized access beyond the credential's intended time-to-live TTL. This issue occurs because the AppRole authentication method does not verify Secret ID expiration at the time...

CVE-2026-115359

A flaw was found in OpenBao. When processing requests with form-encoded bodies or forwarded certificates, the rate limit quota subsystem fails to resolve backend roles properly, preventing quota rules from being enforced. A remote caller can exploit this flaw to bypass rate limits and repeatedly...

CVE-2026-115358

A flaw was found in OpenBao. When processing requests with malformed plugin parameters, such as key-value pair or header fields, error messages containing sensitive input are recorded in audit logs. An authenticated remote attacker can exploit this issue by submitting crafted requests to trigger...

CVE-2026-115357

A flaw was found in OpenBao. Under certain conditions, the service fails to record audit log entries for responses when processing requests to generate root tokens or rotate encryption keys. A remote attacker can complete these critical operations without leaving a complete audit trail, hindering...

CVE-2026-115366

A flaw was found in OpenBao. An improper authorization vulnerability in the plugin catalog interface allows an authenticated user with privileged access in a child namespace to modify system-wide plugin configurations. Because access to these endpoints is not restricted to the root namespace, an...

CVE-2026-115361

A flaw was found in OpenBao. When evaluating access control list ACL policies that combine broad wildcard permissions with specific identity-based denial rules, the application improperly drops explicit deny rules if the identity metadata includes wildcard or path segments. An authenticated user...

CVE-2026-115356

A flaw was found in OpenBao. When renewing an access token issued through the Kubernetes authentication method, OpenBao fails to verify whether the underlying Kubernetes service account remains valid. An authenticated attacker can exploit this issue by repeatedly renewing their token to maintain...

[SECURITY] Fedora 45 Update: openbao-2.6.4-1.fc45

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

CLEANSTART-2026-IX31999 OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

Security vulnerability affects the opentofu package. OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys...

Fedora 45 : openbao (2026-c0f7a19ee3)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c0f7a19ee3 advisory. Update to upstream 2.6.4. Includes multiple GHSA security notices, see https://github.com/openbao/openbao/releases/tag/v2.6.4 ---- Update to 2.6.3-2. Fixes...

CLEANSTART-2026-CL56370 Security fix for GHSA-hfvc-g4fc-pqhx applied in: kube-state-metrics 2.18.0-r2, bank-vaults 1.32.1-r1, etcd 3.6.10-r0, grafana 13.0.0-r0, minio 0.20250907.161309-r3, openbao 2.5.4-r1, velero 1.16.2-r4, argo-cd-fips 3.3.7-r0, temporal-server-fips 1.31.1-r1, kube-state-metrics 2.17.0-r1, cortex 1.21.1-r2, cortex 1.21.1-r3, thanos 0.41.0-r0, fulcio 1.8.7-r2, metrics-server 0.8.1-r2, metrics-server 0.8.1-r3, prometheus 3.10.0-r1

GHSA-hfvc-g4fc-pqhx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SG72830 Security fix for GHSA-mh2q-q3fh-2475 applied in: bank-vaults 1.32.1-r1, minio 0.20250907.161309-r3, rclone 1.72.1-5, rclone 1.73.5-r0, haproxy-ingress 0.15.4-r0, openbao 2.5.4-r1, argo-cd-fips 3.3.7-r0, cortex 1.21.1-r2, cortex 1.21.1-r3, external-secrets-operator-fips 2.4.1-r0, thanos 0.41.0-r0, fulcio 1.8.7-r2, prometheus 3.10.0-r1

GHSA-mh2q-q3fh-2475 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...