Skip to content
OpenAdvisories
High WID-SEC-2026-3540 6 CVEs

OpenBao: Mehrere Schwachstellen

Published Sep 23, 2026 · Updated Oct 22, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Benutzer umzuleiten, Daten zu manipulieren, beliebigen Code auszuführen oder einen Denial-of-Service-Zustand auszulösen.

Product

OpenBao ist eine Open-Source-Lösung für Secrets Management, die sensible Daten wie Passwörter, API-Schlüssel und Zertifikate sicher speichert und verwaltet.

Vulnerabilities 6

  • Medium 6.6
    CVE-2026-115365

    OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

    OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilit…

    openbao openbao
  • Medium 4.7
    CVE-2026-115360

    OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

    OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling p…

    openbao openbao
  • Medium 4.1
    CVE-2026-115361

    OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

    OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that…

    openbao openbao
  • Low 2.6
    CVE-2026-115366

    OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

    OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove exist…

    openbao openbao
  • Low 2.2
    CVE-2026-115364

    OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

    OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1…

    openbao openbao
  • Low 2.0
    CVE-2026-115358

    OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

    OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, caus…

    openbao openbao

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-115358, EUVD-2026-108283, CVE-2026-115365, EUVD-2026-108290, CVE-2026-115364, EUVD-2026-108289, CVE-2026-115366, EUVD-2026-108291, CVE-2026-115361, EUVD-2026-108286, CVE-2026-115360, EUVD-2026-108285

  2. #1

    Initiale Fassung

References