CVE-2026-115369 OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowedipsanscidr restriction on IP SANs taken from a CSR when usecsrsans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/ and obtain CA-signed certificates for unauthoriz...

CVE-2026-115369

The OpenBao software (versions 2.5.0 before 2.6.2) contains a vulnerability where it fails to enforce the allowed_ip_sans_cidr restriction on IP SANs. When use_csr_sans is enabled, authenticated callers with sign permission can submit a Certificate Signing Request (CSR) containing an out-of-range...

CVE-2026-115369 OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowedipsanscidr restriction on IP SANs taken from a CSR when usecsrsans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/ and obtain CA-signed certificates for unauthoriz...