CVE-2026-104090

Impact In OpenBao, the "sys/storage/raft/snapshot" and "sys/storage/raft/snapshot-force" endpoint is a highly privileged endpoint to replace the current storage state, including the plugin catalog. The latter API allows replacement of storage state to a state unrelated to the current storage,...

WS-2026-0082

OpenBao before 2.6.3 / 2.7.0-beta allowed a privileged operator to achieve remote code execution through the sys/storage/raft/snapshot-force endpoint: force-restoring a crafted Raft snapshot could replace plugin catalog entries, and OpenBao then executed the attacker-chosen plugin binary without...

Vault Enterprise’s DR Secondaries Allowed Raft Peer Removal Without Authentication

Summary Vault Enterprise 1.6.0 and 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. This vulnerability, CVE-2021-3282, was fixed in Vault Enterprise 1.6.2. Background Vault Enterprise clusters configured with integrated storage also...