GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: cluster-api-aws-controller, cortex-fips, aws-network-policy-agent-fips, crossplane-provider-aws-redshiftserverless, pulumi-language-dotnet, descheduler-fips, kyverno-policy-reporter-ui-fips, rabbitmq-cluster-operator-fips, consul-fips, cloud-provider-aws-fips,...

[SECURITY] Fedora 44 Update: openbao-2.5.5-1.fc44

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: fscrypt, vault-benchmark, kyverno, eksctl, mattermost, external-dns, prometheus-operator, opentofu, act, apko, helm, snyk-cli, flux, gh, buildah, docker, spire-server, pulumi, teleport, cloud-provider-aws, kubernetes, pulumi-language-java,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: fscrypt, crossplane-provider-aws-elasticache, vault-benchmark, kyverno, eksctl, mattermost, external-dns, prometheus-operator, opentofu, act, crossplane-provider-aws-cloudwatchlogs, apko, crossplane-provider-aws-sns, helm, snyk-cli, flux, gh, buildah,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: fscrypt, kyverno, mattermost, external-dns, prometheus-operator, opentofu, act, apko, helm, snyk-cli, flux, buildah, spire-server, pulumi, cloud-provider-aws, kubernetes, pulumi-language-java, telegraf, cilium-cli, external-secrets-operator, chezmoi, kine, trivy,...

GO-2026-5657 OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL in github.com/openbao/openbao

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2026-5674 OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao

OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao...

GO-2026-5526 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation in github.com/openbao/openbao

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation in github.com/openbao/openbao...

GO-2026-5517 OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao

OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao...

GO-2026-5574 OpenBao's Inline Auth Incorrectly Redacted Headers in github.com/openbao/openbao

OpenBao's Inline Auth Incorrectly Redacted Headers in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2026-5609 OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) in github.com/openbao/openbao

OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction DoS in github.com/openbao/openbao...

GO-2026-5304 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/revoke,renew — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao...

GO-2026-5267 OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types in github.com/openbao/openbao

OpenBao: Transit secrets engine crashes on key creation with derived: true for asymmetric key types in github.com/openbao/openbao...

GO-2026-5213 OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate in github.com/openbao/openbao

OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate in github.com/openbao/openbao...

GO-2026-5225 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-5182 OpenBao: LDAPi ldaputil (wrong escape func) in github.com/openbao/openbao

OpenBao: LDAPi ldaputil wrong escape func in github.com/openbao/openbao...

GO-2026-5192 OpenBao's SQL Injection in PostgreSQL database secrets engine in github.com/openbao/openbao

OpenBao's SQL Injection in PostgreSQL database secrets engine in github.com/openbao/openbao...

GHSA-8W8F-R2XV-4Q4J OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

On OpenBao 2.5.4 and 2.5.2and likely earlier versions also, an authenticated caller with write access to transit/keys/ can crash the OpenBao server by issuing a single key-creation request that combines an asymmetric type rsa-, ecdsa-, ed25519 with derived: true. The server returns no HTTP respon...

GHSA-MWR2-WMGP-CRJ6 OpenBao's System Backend allows Unauthorized Management of the containing Namespace

Summary A user that is granted namespace management /sys/namespaces capabilities within a non-root namespace "the victim namespace" can abuse special handling of the literal path "root" in namespace path canonicalization to manage the victim namespace itself. Details Several endpoints under...

GHSA-C36X-H252-G9X2 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

Summary OpenBao users with access to the sys/leases/revoke/:leaseid endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations. Impact OpenBao's namespaces provide multi-tena...