CVE-2026-115362

A flaw was found in OpenBao. An attacker holding an expired AppRole Secret ID can authenticate to the system and gain unauthorized access beyond the credential's intended time-to-live TTL. This issue occurs because the AppRole authentication method does not verify Secret ID expiration at the time...

BIT-OPENBAO-2026-115362 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

PT-2026-132454

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to improper expiration checks in the AppRole authentication process. An attacker can gain unauthorized access by using an expired Secret ID that has not yet been removed by the periodic tidy operation...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to improper expiration checks in the AppRole authentication process. An attacker can gain unauthorized access by using an expired Secret ID that has not yet been removed by the periodic tidy operation...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to improper expiration checks in the AppRole authentication process. An attacker can gain unauthorized access by using an expired Secret ID that has not yet been removed by the periodic tidy operation...

CVE-2026-115362

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

EUVD-2026-108287

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

CVE-2026-115362

The OpenBao software (versions before 2.6.4 and 2.7.x before 2.7.1 ) contains a vulnerability where the AppRole authentication method fails to verify the expiration of Secret IDs during use. This flaw allows an attacker possessing an expired, untidied Secret ID to bypass the intended Time-To-Live...

CVE-2026-115362 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

CVE-2026-115362 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

CVE-2026-115362 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

CVE-2026-115362

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

OpenBao session mechanism vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a session mechanism vulnerability. This vulnerability arises because the AppRole authentication method fails to verify whether a Secret ID has expired; as a result, expired Secret IDs remain valid until they are periodicall...

PT-2026-121542

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1 Description The AppRole authentication method fails to verify the expiration of the Secret ID during use. This allows an attacker possessing an expired Secret ID that has no...

Exploit for CVE-2026-57836

CVE-2026-57836: Disabled TLS Certificate Verification for Hash...

BIT-CONSUL-2026-8715 Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

Security Bulletin: Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Summary Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit the...

CVE-2026-8715

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

CVE-2026-8715

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...