Skip to content
OpenAdvisories

Package · Alpine

openbao

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 2.0
    CVE-2026-40264

    OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

    OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in anoth…

    openbao openbao openbao github.com/openbao/openbao Alpine Wolfi Go
  • Low 3.1
    CVE-2026-39396

    OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no …

    openbao openbao openbao github.com/openbao/openbao Alpine Wolfi Go
  • Low 2.0
    CVE-2026-39388

    OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mT…

    openbao openbao openbao github.com/openbao/openbao Alpine Wolfi Go
  • Low 3.7
    CVE-2025-54999

    OpenBao: Timing Side-Channel in Userpass Auth Method

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing di…

    openbao openbao github.com/openbao/openbao openbao Alpine Go