CVE-2026-126310

OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with clientcredentials enabled. Attackers who know a public client's clientid can request tokens from the...

CVE-2026-126309

Versions of OpenBao prior to 2.6.5 and 2.7.2 are vulnerable to a path traversal vulnerability within the Transit key import functionality. This flaw allows authenticated attackers to bypass name restrictions defined in ACL policies. Specifically, attackers subject to a required_parameters name co...

EUVD-2026-125211

OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a requiredparameters name constraint can craft traversal sequences during import to write key material...

CVE-2026-126310 OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials

OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with clientcredentials enabled. Attackers who know a public client's clientid can request tokens from the...

CVE-2026-126311

OpenBao versions prior to 2.6.5 and 2.7.x before 2.7.2 are vulnerable to a flaw where the SSH secrets engine fails to neutralize wildcard characters in SSH certificate principals. The root cause is the rendering of unvalidated external token metadata via identity templates . An attacker who contr...

EUVD-2026-125210

OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with clientcredentials enabled. Attackers who know a public client's clientid can request tokens from the...

EUVD-2026-125209

OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity...

CVE-2026-126310

Versions of OpenBao prior to 2.6.5 and 2.7.2 are vulnerable to an authentication bypass in the OIDC Provider. The flaw allows unauthenticated callers to obtain OIDC ID tokens by exploiting public clients that have client_credentials enabled. Specifically, an attacker who knows a public client's c...

CVE-2026-126312

The OpenBao software versions prior to 2.6.5 and 2.7.x (before 2.7.2 ) are vulnerable to an ACL bypass via non-canonical plugin paths. This flaw exists in the AppRole, Cert, LDAP, and RADIUS authentication methods, as well as in the openbao-plugins LDAP and RADIUS auth plugins before version 0.2....

EUVD-2026-125208

OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole...

[SECURITY] Fedora 43 Update: openbao-2.6.5-1.fc43

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

[SECURITY] Fedora 44 Update: openbao-2.6.5-1.fc44

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

[SECURITY] Fedora 45 Update: openbao-2.6.5-1.fc45

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

Fedora 43 : openbao (2026-5f701776a6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5f701776a6 advisory. Update to upstream 2.6.5 which includes a number of security fixes, see https://github.com/openbao/openbao/releases/v2.6.5. Also fixes golang CVE-2026-111943...

Fedora 45 : openbao (2026-fc3fbffe59)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fc3fbffe59 advisory. Update to upstream 2.6.5 which includes a number of security fixes, see https://github.com/openbao/openbao/releases/v2.6.5. Also fixes golang CVE-2026-111943...

Fedora 44 : openbao (2026-d255ce2e09)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d255ce2e09 advisory. Update to upstream 2.6.5 which includes a number of security fixes, see https://github.com/openbao/openbao/releases/v2.6.5. Also fixes golang CVE-2026-111943...

CVE-2026-115364

A flaw was found in OpenBao. This vulnerability allows a remote attacker to cause a Denial of Service DoS by shutting down Agent and Proxy services. Due to a missing authorization check, administrative termination endpoints fail to validate the presence of the required security header even when...

CVE-2026-115363

A flaw was found in OpenBao. When External Account Binding EAB is configured with the Automatic Certificate Management Environment ACME to manage certificates, the sanitized configuration endpoint fails to redact the EAB Message Authentication Code MAC key. An authenticated user with permission t...

CVE-2026-115362

A flaw was found in OpenBao. An attacker holding an expired AppRole Secret ID can authenticate to the system and gain unauthorized access beyond the credential's intended time-to-live TTL. This issue occurs because the AppRole authentication method does not verify Secret ID expiration at the time...

CVE-2026-115359

A flaw was found in OpenBao. When processing requests with form-encoded bodies or forwarded certificates, the rate limit quota subsystem fails to resolve backend roles properly, preventing quota rules from being enforced. A remote caller can exploit this flaw to bypass rate limits and repeatedly...