CVE-2026-104090

Impact In OpenBao, the "sys/storage/raft/snapshot" and "sys/storage/raft/snapshot-force" endpoint is a highly privileged endpoint to replace the current storage state, including the plugin catalog. The latter API allows replacement of storage state to a state unrelated to the current storage,...

WS-2026-0082

OpenBao before 2.6.3 / 2.7.0-beta allowed a privileged operator to achieve remote code execution through the sys/storage/raft/snapshot-force endpoint: force-restoring a crafted Raft snapshot could replace plugin catalog entries, and OpenBao then executed the attacker-chosen plugin binary without...