CVE-2026-115363

Versions OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 are susceptible to an information disclosure vulnerability. The sys/config/state/sanitized endpoint improperly exposes the tls_acme_eab_mac_key value. Attackers who can access this endpoint can retrieve the ACME External Account Binding M...

EUVD-2026-108288

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tlsacmeeabmackey value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used f...