Summary
Ein lokaler Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen.
Product
OpenBao ist eine Open-Source-Lösung für Secrets Management, die sensible Daten wie Passwörter, API-Schlüssel und Zertifikate sicher speichert und verwaltet.
Vulnerabilities 2
-
Medium 5.4
OpenBao's Inline Auth Incorrectly Redacted Headers
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in clea…
-
Medium 5.3
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the response is includes a `logical.Auth` object in a…
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-54683, EUVD-2026-54653
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-7j6w-vvw2-5f9c vom 2026-05-20
https://github.com/openbao/openbao/security/advisories/GHSA-7j6w-vvw2-5f9c
-
GitHub Security Advisory GHSA-q8cj-789h-vg24 vom 2026-05-20
https://github.com/openbao/openbao/security/advisories/GHSA-q8cj-789h-vg24