BIT-OPENBAO-2026-115357 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root...

PT-2026-132449

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging due to improper audit logging in the sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker can hinder forensic detection...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging due to improper audit logging in the sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker can hinder forensic detection...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging due to improper audit logging in the sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker can hinder forensic detection...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging due to improper audit logging in the sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker can hinder forensic detection...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging due to improper audit logging in the sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker can hinder forensic detection...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging due to improper audit logging in the sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker can hinder forensic detection...

CVE-2026-115357

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root...

CVE-2026-115357

OpenBao versions prior to 2.6.4 and 2.7.x before 2.7.1 are affected by an improper audit logging vulnerability. The software fails to record response audit entries for the unauthenticated sys/generate-root , sys/rekey , and sys/rekey-recovery-key endpoints in specific scenarios where request logg...

CVE-2026-115357 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root...

CVE-2026-115357 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root...

CVE-2026-115357

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root...

EUVD-2026-108282

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root...

CVE-2026-115357 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root...

OpenBao log information leakage vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a log information leakage vulnerability. This occurs when request audit logs are successfully recorded but response audit logs fail to be recorded; as a result, no response audit entries are written for unauthenticated...

PT-2026-121537

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1 Description Failure to write response audit entries occurs for the unauthenticated 'sys/generate-root', 'sys/rekey', and 'sys/rekey-recovery-key' endpoints when request audi...

Allocation of Resources Without Limits or Throttling

Overview github.com/hashicorp/vault/vault is a tool for securely accessing secrets. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HandlerFunc and ReKey related operations in http/handler.go and vault/core.go. An attacker can start...

Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

Summary Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This...