GO-2026-6579 OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao

OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao...

GO-2026-5574 OpenBao's Inline Auth Incorrectly Redacted Headers in github.com/openbao/openbao

OpenBao's Inline Auth Incorrectly Redacted Headers in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2026-5526 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation in github.com/openbao/openbao

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation in github.com/openbao/openbao...

GO-2026-5225 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the sys/revoke and sys/renew endpoints. An attacker can revoke or renew leases and underlying credentials belonging to other tenants by exploiting these endpoints if they have access to leaked lease...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the processing of malicious JSON payloads in the request handling process. An attacker can exhaust system memory and CPU resources by sending specially crafted JSON objects that, when deserialized, consume...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization via the usernameasalias parameter in the LDAP authentication process. An attacker can gain unauthorized access to resources protected by multi-factor authentication by supplying a crafted username that bypasses...