GO-2026-6579 OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao

OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao...

GO-2026-6553 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao...

GO-2026-6554 OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao

OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao...

GO-2026-6556 OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters in github.com/openbao/openbao

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters in github.com/openbao/openbao...

BIT-OPENBAO-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

BIT-OPENBAO-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

BIT-OPENBAO-2026-63131 OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = "deny" for a LIST operation. When a parent path permitted LIST and a...

[SECURITY] Fedora 43 Update: openbao-2.6.3-2.fc43

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

PT-2026-105124

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

PT-2026-105125

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num...

PT-2026-105574

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao...

PT-2026-105577

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters in github.com/openbao/openbao...

PT-2026-105575

OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao...

PT-2026-105598

OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao...

Fedora 43 : openbao (2026-ccc419650a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ccc419650a advisory. Update to 2.6.3-2. Fixes privilege problem in the service file and cleans up default configuration file. ---- Update to 2.6.3. Includes fixes to multiple GHS...

PT-2026-105123

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = "deny" for a LIST operation. When a parent path permitted LIST and a...

BIT-OPENBAO-2026-71543 OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter pa...

PT-2026-102743

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter pa...

The vulnerability of OpenBao’s secret and encryption management system, related to inadequate access control, allows attackers to enhance their privileges.

The vulnerability of the OpenBao encryption and secret management system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

SUSE CVE-2026-63132

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...