Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the processing of plugin parameters. An attacker can cause sensitive input data to be recorded in audit logs by submitting requests with malformed values in the TypeKVPair or TypeHeade...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the processing of plugin parameters. An attacker can cause sensitive input data to be recorded in audit logs by submitting requests with malformed values in the TypeKVPair or TypeHeade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...

Incorrect Authorization

Overview github.com/openbao/openbao/sdk/v2/helper/identitytpl is a None Affected versions of this package are vulnerable to Incorrect Authorization. in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing...

WS-2026-0080

The OpenBao SDK github.com/openbao/openbao/sdk/v2 before v2.6.3 / v2.7.1: the framework field parser getPrimitive for TypeKVPair and TypeHeader fields copied the raw invalid submitted value into its error message. Because error messages reach the audit log without HMAC redaction, sensitive values...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the templated policy processing. An attacker can gain unauthorized access, escalate privileges, or issue unauthorized certificates by injecting wildcard or syntax-significant characters into identity data...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the templated policy processing. An attacker can gain unauthorized access, escalate privileges, or issue unauthorized certificates by injecting wildcard or syntax-significant characters into identity data...