{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "openbao: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/openbao--openbao/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/openbao--openbao/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115369/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115369/",
   "title": "CVE-2026-115369 disclosed",
   "content_text": "OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/\u003crole\u003e and obtain CA-signed certificates for unauthorized IPs.",
   "date_published": "2026-10-22T19:13:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115366/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115366/",
   "title": "CVE-2026-115366 disclosed",
   "content_text": "OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.",
   "date_published": "2026-10-22T19:13:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115365/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115365/",
   "title": "CVE-2026-115365 disclosed",
   "content_text": "OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.",
   "date_published": "2026-10-22T19:13:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115364/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115364/",
   "title": "CVE-2026-115364 disclosed",
   "content_text": "OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.",
   "date_published": "2026-10-22T19:13:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115363/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115363/",
   "title": "CVE-2026-115363 disclosed",
   "content_text": "OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.",
   "date_published": "2026-10-22T19:13:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115362/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115362/",
   "title": "CVE-2026-115362 disclosed",
   "content_text": "OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.",
   "date_published": "2026-10-22T19:13:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115361/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115361/",
   "title": "CVE-2026-115361 disclosed",
   "content_text": "OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.",
   "date_published": "2026-10-22T19:13:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115360/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115360/",
   "title": "CVE-2026-115360 disclosed",
   "content_text": "OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.",
   "date_published": "2026-10-22T19:13:35Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115359/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115359/",
   "title": "CVE-2026-115359 disclosed",
   "content_text": "OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.",
   "date_published": "2026-10-22T19:13:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115358/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115358/",
   "title": "CVE-2026-115358 disclosed",
   "content_text": "OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.",
   "date_published": "2026-10-22T19:13:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115357/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115357/",
   "title": "CVE-2026-115357 disclosed",
   "content_text": "OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.",
   "date_published": "2026-10-22T19:13:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115356/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115356/",
   "title": "CVE-2026-115356 disclosed",
   "content_text": "OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.",
   "date_published": "2026-10-22T19:13:32Z"
  }
 ]
}