Skip to content
OpenAdvisories
Medium WID-SEC-2026-2343 4 CVEs

OpenBao: Mehrere Schwachstellen

Published Jul 14, 2026 · Updated Sep 23, 2026 · Revision 3 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

Product

OpenBao ist eine Open-Source-Lösung für Secrets Management, die sensible Daten wie Passwörter, API-Schlüssel und Zertifikate sicher speichert und verwaltet.

Vulnerabilities 4

  • Critical 9.2
    CVE-2026-63132

    OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

    OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to …

    openbao openbao github.com/openbao/openbao Go
  • High 7.5
    CVE-2026-71543

    OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

    OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, …

    openbao openbao github.com/openbao/openbao Go
  • Medium 6.0
    CVE-2026-63131

    OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

    OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. W…

    openbao openbao github.com/openbao/openbao Go
  • Low 2.4
    CVE-2026-77285

    OpenBao Agent Writes Secrets to Stdout

    OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rend…

    openbao openbao github.com/openbao/openbao Go

Revision history

  1. #3

    CVE's ergänzt

  2. #2

    CVE-2026-71543 ergänzt

  3. #1

    Initiale Fassung

References