{"schema_version":"2","view":"grouped","data":[{"id":64610,"cve_ids":["CVE-2026-63131"],"payload":{"kind":"advisory","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-63131","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63131","aliases":["CVE-2026-63131"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"< 2.6.0"}]}],"modified":"2026-09-24T14:15:04.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63131","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:14:55.010515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:15:04.716Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:59:16.337Z"}}},"related_cves":[{"value":"CVE-2026-63131","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-63131","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-63131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63131","advisory_id":"cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","event_types":["advisory"],"published_at":"2026-10-25T19:52:29.340122+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T17:59:16.337+00:00","detail_url":"/advisories/advisory%3Acc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","group":{"id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","revision":1,"primary_event_id":63919,"change":"published","superseded_by":[],"changed":{"id":63919,"cve_ids":["CVE-2026-63131"],"payload":{"kind":"advisory","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-63131","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63131","aliases":["CVE-2026-63131"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"< 2.6.0"}]}],"modified":"2026-09-24T14:15:04.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63131","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:14:55.010515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:15:04.716Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:59:16.337Z"}}},"related_cves":[{"value":"CVE-2026-63131","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-63131","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-63131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63131","advisory_id":"cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","event_types":["advisory"],"published_at":"2026-10-25T19:52:29.340122+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T17:59:16.337+00:00","detail_url":"/events/63919"},"members":[{"id":63919,"cve_ids":["CVE-2026-63131"],"payload":{"kind":"advisory","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-63131","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63131","aliases":["CVE-2026-63131"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"< 2.6.0"}]}],"modified":"2026-09-24T14:15:04.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63131","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:14:55.010515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:15:04.716Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:59:16.337Z"}}},"related_cves":[{"value":"CVE-2026-63131","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-63131","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-63131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63131","advisory_id":"cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","event_types":["advisory"],"published_at":"2026-10-25T19:52:29.340122+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T17:59:16.337+00:00","detail_url":"/events/63919"}]}},{"id":64598,"cve_ids":["CVE-2026-71543"],"payload":{"kind":"advisory","title":"OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-71543","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-71543","aliases":["CVE-2026-71543"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"<2.6.0"}]}],"modified":"2026-09-25T19:26:50.747Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p","https://github.com/openbao/openbao/pull/3401","https://github.com/openbao/openbao/pull/3473","https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1","https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-71543","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T19:26:34.934696Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:26:50.747Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:03:59.159Z"}}},"related_cves":[{"value":"CVE-2026-71543","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b04ed4bc-737d-44ca-8609-ed5fb68f1298","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-71543","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-71543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-71543","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.0.0-20260710001938-2d4ebafec5c5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-59w7-v8rr-pr4p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":3,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71543","advisory_id":"b04ed4bc-737d-44ca-8609-ed5fb68f1298","event_types":["advisory"],"published_at":"2026-10-25T19:52:19.742669+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T15:03:59.159+00:00","detail_url":"/advisories/advisory%3Ab04ed4bc-737d-44ca-8609-ed5fb68f1298","group":{"id":"advisory:b04ed4bc-737d-44ca-8609-ed5fb68f1298","revision":1,"primary_event_id":63900,"change":"published","superseded_by":[],"changed":{"id":63900,"cve_ids":["CVE-2026-71543"],"payload":{"kind":"advisory","title":"OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-71543","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-71543","aliases":["CVE-2026-71543"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"<2.6.0"}]}],"modified":"2026-09-25T19:26:50.747Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p","https://github.com/openbao/openbao/pull/3401","https://github.com/openbao/openbao/pull/3473","https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1","https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-71543","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T19:26:34.934696Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:26:50.747Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:03:59.159Z"}}},"related_cves":[{"value":"CVE-2026-71543","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b04ed4bc-737d-44ca-8609-ed5fb68f1298","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-71543","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-71543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-71543","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.0.0-20260710001938-2d4ebafec5c5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-59w7-v8rr-pr4p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":3,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71543","advisory_id":"b04ed4bc-737d-44ca-8609-ed5fb68f1298","event_types":["advisory"],"published_at":"2026-10-25T19:52:19.742669+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-21T15:03:59.159+00:00","detail_url":"/events/63900"},"members":[{"id":63900,"cve_ids":["CVE-2026-71543"],"payload":{"kind":"advisory","title":"OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-71543","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-71543","aliases":["CVE-2026-71543"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"<2.6.0"}]}],"modified":"2026-09-25T19:26:50.747Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p","https://github.com/openbao/openbao/pull/3401","https://github.com/openbao/openbao/pull/3473","https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1","https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-71543","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T19:26:34.934696Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:26:50.747Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:03:59.159Z"}}},"related_cves":[{"value":"CVE-2026-71543","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b04ed4bc-737d-44ca-8609-ed5fb68f1298","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-71543","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-71543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-71543","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.0.0-20260710001938-2d4ebafec5c5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-59w7-v8rr-pr4p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":3,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71543","advisory_id":"b04ed4bc-737d-44ca-8609-ed5fb68f1298","event_types":["advisory"],"published_at":"2026-10-25T19:52:19.742669+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-21T15:03:59.159+00:00","detail_url":"/events/63900"}]}},{"id":53711,"cve_ids":["CVE-2026-115360"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI","summary":"OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.","evidence":"cve:CVE-2026-115360","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115360","aliases":["CVE-2026-115360"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":4.7,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-23T21:07:08.070Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-2cjw-94fw-wqjx","https://www.vulncheck.com/advisories/openbao-before-2.6.3-open-redirect-via-oidc-identity-provider-ui"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115360","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T17:33:04.725604Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T21:07:08.070Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:35.435Z"}}},"related_cves":[{"value":"CVE-2026-115360","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:727d5b0d-cbd1-483f-871d-acfe88aabe5e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115360","advisory_id":"727d5b0d-cbd1-483f-871d-acfe88aabe5e","event_types":["advisory"],"published_at":"2026-10-25T14:58:21.852607+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:35.435+00:00","detail_url":"/advisories/advisory%3A727d5b0d-cbd1-483f-871d-acfe88aabe5e","group":{"id":"advisory:727d5b0d-cbd1-483f-871d-acfe88aabe5e","revision":1,"primary_event_id":53240,"change":"published","superseded_by":[],"changed":{"id":53240,"cve_ids":["CVE-2026-115360"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI","summary":"OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.","evidence":"cve:CVE-2026-115360","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115360","aliases":["CVE-2026-115360"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":4.7,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-23T21:07:08.070Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-2cjw-94fw-wqjx","https://www.vulncheck.com/advisories/openbao-before-2.6.3-open-redirect-via-oidc-identity-provider-ui"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115360","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T17:33:04.725604Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T21:07:08.070Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:35.435Z"}}},"related_cves":[{"value":"CVE-2026-115360","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:727d5b0d-cbd1-483f-871d-acfe88aabe5e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115360","advisory_id":"727d5b0d-cbd1-483f-871d-acfe88aabe5e","event_types":["advisory"],"published_at":"2026-10-25T14:58:21.852607+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:35.435+00:00","detail_url":"/events/53240"},"members":[{"id":53240,"cve_ids":["CVE-2026-115360"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI","summary":"OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.","evidence":"cve:CVE-2026-115360","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115360","aliases":["CVE-2026-115360"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":4.7,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-23T21:07:08.070Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-2cjw-94fw-wqjx","https://www.vulncheck.com/advisories/openbao-before-2.6.3-open-redirect-via-oidc-identity-provider-ui"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115360","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T17:33:04.725604Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T21:07:08.070Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:35.435Z"}}},"related_cves":[{"value":"CVE-2026-115360","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:727d5b0d-cbd1-483f-871d-acfe88aabe5e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115360","advisory_id":"727d5b0d-cbd1-483f-871d-acfe88aabe5e","event_types":["advisory"],"published_at":"2026-10-25T14:58:21.852607+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:35.435+00:00","detail_url":"/events/53240"}]}},{"id":53502,"cve_ids":["CVE-2026-115364"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints","summary":"OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.","evidence":"cve:CVE-2026-115364","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115364","aliases":["CVE-2026-115364"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:02:16.016Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-8gmq-wv9h-fcwp","https://www.vulncheck.com/advisories/openbao-before-2.6.3-missing-header-check-on-agent-proxy-quit-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115364","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:22.144861Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:02:16.016Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:38.282Z"}}},"related_cves":[{"value":"CVE-2026-115364","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f711a830-3bd3-42ef-82c2-ed7345e89643","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115364","advisory_id":"f711a830-3bd3-42ef-82c2-ed7345e89643","event_types":["advisory"],"published_at":"2026-10-25T14:54:56.308594+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:38.282+00:00","detail_url":"/advisories/advisory%3Af711a830-3bd3-42ef-82c2-ed7345e89643","group":{"id":"advisory:f711a830-3bd3-42ef-82c2-ed7345e89643","revision":1,"primary_event_id":53031,"change":"published","superseded_by":[],"changed":{"id":53031,"cve_ids":["CVE-2026-115364"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints","summary":"OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.","evidence":"cve:CVE-2026-115364","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115364","aliases":["CVE-2026-115364"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:02:16.016Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-8gmq-wv9h-fcwp","https://www.vulncheck.com/advisories/openbao-before-2.6.3-missing-header-check-on-agent-proxy-quit-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115364","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:22.144861Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:02:16.016Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:38.282Z"}}},"related_cves":[{"value":"CVE-2026-115364","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f711a830-3bd3-42ef-82c2-ed7345e89643","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115364","advisory_id":"f711a830-3bd3-42ef-82c2-ed7345e89643","event_types":["advisory"],"published_at":"2026-10-25T14:54:56.308594+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:38.282+00:00","detail_url":"/events/53031"},"members":[{"id":53031,"cve_ids":["CVE-2026-115364"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints","summary":"OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.","evidence":"cve:CVE-2026-115364","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115364","aliases":["CVE-2026-115364"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:02:16.016Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-8gmq-wv9h-fcwp","https://www.vulncheck.com/advisories/openbao-before-2.6.3-missing-header-check-on-agent-proxy-quit-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115364","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:22.144861Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:02:16.016Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:38.282Z"}}},"related_cves":[{"value":"CVE-2026-115364","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f711a830-3bd3-42ef-82c2-ed7345e89643","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115364","advisory_id":"f711a830-3bd3-42ef-82c2-ed7345e89643","event_types":["advisory"],"published_at":"2026-10-25T14:54:56.308594+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:38.282+00:00","detail_url":"/events/53031"}]}},{"id":53501,"cve_ids":["CVE-2026-115356"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.","evidence":"cve:CVE-2026-115356","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115356","aliases":["CVE-2026-115356"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:02:35.215Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-gf3j-hm38-jhh5","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-kubernetes-auth-method-token-renewal-after-revocation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115356","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:20.511757Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:02:35.215Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:32.611Z"}}},"related_cves":[{"value":"CVE-2026-115356","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebebd68e-dcf7-4bb2-ab65-fcea0d84b0ff","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115356","advisory_id":"ebebd68e-dcf7-4bb2-ab65-fcea0d84b0ff","event_types":["advisory"],"published_at":"2026-10-25T14:54:55.680032+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:32.611+00:00","detail_url":"/advisories/advisory%3Aebebd68e-dcf7-4bb2-ab65-fcea0d84b0ff","group":{"id":"advisory:ebebd68e-dcf7-4bb2-ab65-fcea0d84b0ff","revision":1,"primary_event_id":53030,"change":"published","superseded_by":[],"changed":{"id":53030,"cve_ids":["CVE-2026-115356"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.","evidence":"cve:CVE-2026-115356","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115356","aliases":["CVE-2026-115356"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:02:35.215Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-gf3j-hm38-jhh5","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-kubernetes-auth-method-token-renewal-after-revocation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115356","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:20.511757Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:02:35.215Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:32.611Z"}}},"related_cves":[{"value":"CVE-2026-115356","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebebd68e-dcf7-4bb2-ab65-fcea0d84b0ff","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115356","advisory_id":"ebebd68e-dcf7-4bb2-ab65-fcea0d84b0ff","event_types":["advisory"],"published_at":"2026-10-25T14:54:55.680032+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:32.611+00:00","detail_url":"/events/53030"},"members":[{"id":53030,"cve_ids":["CVE-2026-115356"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.","evidence":"cve:CVE-2026-115356","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115356","aliases":["CVE-2026-115356"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:02:35.215Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-gf3j-hm38-jhh5","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-kubernetes-auth-method-token-renewal-after-revocation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115356","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:20.511757Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:02:35.215Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:32.611Z"}}},"related_cves":[{"value":"CVE-2026-115356","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebebd68e-dcf7-4bb2-ab65-fcea0d84b0ff","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115356","advisory_id":"ebebd68e-dcf7-4bb2-ab65-fcea0d84b0ff","event_types":["advisory"],"published_at":"2026-10-25T14:54:55.680032+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:32.611+00:00","detail_url":"/events/53030"}]}},{"id":52801,"cve_ids":["CVE-2026-115369"],"payload":{"kind":"advisory","title":"OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs","summary":"OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/ and obtain CA-signed certificates for unauthorized IPs.","evidence":"cve:CVE-2026-115369","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115369","aliases":["CVE-2026-115369"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.5.0","lessThan":"2.6.2","versionType":"semver"},{"status":"unaffected","version":"2.6.2","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:40.448Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-g892-p242-8g86","https://www.vulncheck.com/advisories/openbao-2.5.0-before-2.6.2-pki-allowed-ip-sans-cidr-bypass-via-csr-ip-sans"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:40.448Z"}}},"related_cves":[{"value":"CVE-2026-115369","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:95fcf8f7-532e-45d0-a637-951b98083ac6","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115369","advisory_id":"95fcf8f7-532e-45d0-a637-951b98083ac6","event_types":["advisory"],"published_at":"2026-10-25T14:43:24.916032+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:40.448+00:00","detail_url":"/advisories/advisory%3A95fcf8f7-532e-45d0-a637-951b98083ac6","group":{"id":"advisory:95fcf8f7-532e-45d0-a637-951b98083ac6","revision":1,"primary_event_id":52329,"change":"published","superseded_by":[],"changed":{"id":52329,"cve_ids":["CVE-2026-115369"],"payload":{"kind":"advisory","title":"OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs","summary":"OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/ and obtain CA-signed certificates for unauthorized IPs.","evidence":"cve:CVE-2026-115369","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115369","aliases":["CVE-2026-115369"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.5.0","lessThan":"2.6.2","versionType":"semver"},{"status":"unaffected","version":"2.6.2","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:40.448Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-g892-p242-8g86","https://www.vulncheck.com/advisories/openbao-2.5.0-before-2.6.2-pki-allowed-ip-sans-cidr-bypass-via-csr-ip-sans"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:40.448Z"}}},"related_cves":[{"value":"CVE-2026-115369","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:95fcf8f7-532e-45d0-a637-951b98083ac6","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115369","advisory_id":"95fcf8f7-532e-45d0-a637-951b98083ac6","event_types":["advisory"],"published_at":"2026-10-25T14:43:24.916032+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:40.448+00:00","detail_url":"/events/52329"},"members":[{"id":52329,"cve_ids":["CVE-2026-115369"],"payload":{"kind":"advisory","title":"OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs","summary":"OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/ and obtain CA-signed certificates for unauthorized IPs.","evidence":"cve:CVE-2026-115369","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115369","aliases":["CVE-2026-115369"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.5.0","lessThan":"2.6.2","versionType":"semver"},{"status":"unaffected","version":"2.6.2","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:40.448Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-g892-p242-8g86","https://www.vulncheck.com/advisories/openbao-2.5.0-before-2.6.2-pki-allowed-ip-sans-cidr-bypass-via-csr-ip-sans"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:40.448Z"}}},"related_cves":[{"value":"CVE-2026-115369","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:95fcf8f7-532e-45d0-a637-951b98083ac6","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115369","advisory_id":"95fcf8f7-532e-45d0-a637-951b98083ac6","event_types":["advisory"],"published_at":"2026-10-25T14:43:24.916032+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:40.448+00:00","detail_url":"/events/52329"}]}},{"id":52799,"cve_ids":["CVE-2026-115366"],"payload":{"kind":"advisory","title":"OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs","summary":"OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.","evidence":"cve:CVE-2026-115366","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115366","aliases":["CVE-2026-115366"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.6,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.3.0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:39.752Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-cg72-x35g-xfp8","https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-missing-root-namespace-enforcement-in-plugin-catalog-apis"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:39.752Z"}}},"related_cves":[{"value":"CVE-2026-115366","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fc6595bd-7c00-4fe2-a85d-31b01ae37810","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115366","advisory_id":"fc6595bd-7c00-4fe2-a85d-31b01ae37810","event_types":["advisory"],"published_at":"2026-10-25T14:43:23.457085+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:39.752+00:00","detail_url":"/advisories/advisory%3Afc6595bd-7c00-4fe2-a85d-31b01ae37810","group":{"id":"advisory:fc6595bd-7c00-4fe2-a85d-31b01ae37810","revision":1,"primary_event_id":52327,"change":"published","superseded_by":[],"changed":{"id":52327,"cve_ids":["CVE-2026-115366"],"payload":{"kind":"advisory","title":"OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs","summary":"OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.","evidence":"cve:CVE-2026-115366","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115366","aliases":["CVE-2026-115366"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.6,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.3.0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:39.752Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-cg72-x35g-xfp8","https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-missing-root-namespace-enforcement-in-plugin-catalog-apis"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:39.752Z"}}},"related_cves":[{"value":"CVE-2026-115366","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fc6595bd-7c00-4fe2-a85d-31b01ae37810","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115366","advisory_id":"fc6595bd-7c00-4fe2-a85d-31b01ae37810","event_types":["advisory"],"published_at":"2026-10-25T14:43:23.457085+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:39.752+00:00","detail_url":"/events/52327"},"members":[{"id":52327,"cve_ids":["CVE-2026-115366"],"payload":{"kind":"advisory","title":"OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs","summary":"OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.","evidence":"cve:CVE-2026-115366","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115366","aliases":["CVE-2026-115366"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.6,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.3.0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:39.752Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-cg72-x35g-xfp8","https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-missing-root-namespace-enforcement-in-plugin-catalog-apis"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:39.752Z"}}},"related_cves":[{"value":"CVE-2026-115366","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fc6595bd-7c00-4fe2-a85d-31b01ae37810","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115366","advisory_id":"fc6595bd-7c00-4fe2-a85d-31b01ae37810","event_types":["advisory"],"published_at":"2026-10-25T14:43:23.457085+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:39.752+00:00","detail_url":"/events/52327"}]}},{"id":52798,"cve_ids":["CVE-2026-115365"],"payload":{"kind":"advisory","title":"OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal","summary":"OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.","evidence":"cve:CVE-2026-115365","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-115365","aliases":["CVE-2026-115365"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.3.0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:39.017Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-mjch-vcw3-hhmf","https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-incorrect-authorization-via-policy-cache-namespace-traversal"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:39.017Z"}}},"related_cves":[{"value":"CVE-2026-115365","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:52d985cb-d78a-4b5e-80fe-310e2616d052","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115365","advisory_id":"52d985cb-d78a-4b5e-80fe-310e2616d052","event_types":["advisory"],"published_at":"2026-10-25T14:43:22.775758+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:39.017+00:00","detail_url":"/advisories/advisory%3A52d985cb-d78a-4b5e-80fe-310e2616d052","group":{"id":"advisory:52d985cb-d78a-4b5e-80fe-310e2616d052","revision":1,"primary_event_id":52326,"change":"published","superseded_by":[],"changed":{"id":52326,"cve_ids":["CVE-2026-115365"],"payload":{"kind":"advisory","title":"OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal","summary":"OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.","evidence":"cve:CVE-2026-115365","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-115365","aliases":["CVE-2026-115365"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.3.0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:39.017Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-mjch-vcw3-hhmf","https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-incorrect-authorization-via-policy-cache-namespace-traversal"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:39.017Z"}}},"related_cves":[{"value":"CVE-2026-115365","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:52d985cb-d78a-4b5e-80fe-310e2616d052","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115365","advisory_id":"52d985cb-d78a-4b5e-80fe-310e2616d052","event_types":["advisory"],"published_at":"2026-10-25T14:43:22.775758+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:39.017+00:00","detail_url":"/events/52326"},"members":[{"id":52326,"cve_ids":["CVE-2026-115365"],"payload":{"kind":"advisory","title":"OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal","summary":"OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.","evidence":"cve:CVE-2026-115365","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-115365","aliases":["CVE-2026-115365"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.3.0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:39.017Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-mjch-vcw3-hhmf","https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-incorrect-authorization-via-policy-cache-namespace-traversal"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:39.017Z"}}},"related_cves":[{"value":"CVE-2026-115365","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:52d985cb-d78a-4b5e-80fe-310e2616d052","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115365","advisory_id":"52d985cb-d78a-4b5e-80fe-310e2616d052","event_types":["advisory"],"published_at":"2026-10-25T14:43:22.775758+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:39.017+00:00","detail_url":"/events/52326"}]}},{"id":52797,"cve_ids":["CVE-2026-115363"],"payload":{"kind":"advisory","title":"OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration","summary":"OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.","evidence":"cve:CVE-2026-115363","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115363","aliases":["CVE-2026-115363"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.2.0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:37.600Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp","https://www.vulncheck.com/advisories/openbao-2.2.0-before-2.6.4-and-2.7.0-before-2.7.1-acme-eab-mac-key-disclosure-via-sanitized-configuration"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:37.600Z"}}},"related_cves":[{"value":"CVE-2026-115363","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:476d42e7-4fb4-44fb-b67a-42c348828efd","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115363","advisory_id":"476d42e7-4fb4-44fb-b67a-42c348828efd","event_types":["advisory"],"published_at":"2026-10-25T14:43:22.088387+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:37.6+00:00","detail_url":"/advisories/advisory%3A476d42e7-4fb4-44fb-b67a-42c348828efd","group":{"id":"advisory:476d42e7-4fb4-44fb-b67a-42c348828efd","revision":1,"primary_event_id":52325,"change":"published","superseded_by":[],"changed":{"id":52325,"cve_ids":["CVE-2026-115363"],"payload":{"kind":"advisory","title":"OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration","summary":"OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.","evidence":"cve:CVE-2026-115363","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115363","aliases":["CVE-2026-115363"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.2.0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:37.600Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp","https://www.vulncheck.com/advisories/openbao-2.2.0-before-2.6.4-and-2.7.0-before-2.7.1-acme-eab-mac-key-disclosure-via-sanitized-configuration"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:37.600Z"}}},"related_cves":[{"value":"CVE-2026-115363","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:476d42e7-4fb4-44fb-b67a-42c348828efd","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115363","advisory_id":"476d42e7-4fb4-44fb-b67a-42c348828efd","event_types":["advisory"],"published_at":"2026-10-25T14:43:22.088387+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:37.6+00:00","detail_url":"/events/52325"},"members":[{"id":52325,"cve_ids":["CVE-2026-115363"],"payload":{"kind":"advisory","title":"OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration","summary":"OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.","evidence":"cve:CVE-2026-115363","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115363","aliases":["CVE-2026-115363"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"2.2.0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:37.600Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp","https://www.vulncheck.com/advisories/openbao-2.2.0-before-2.6.4-and-2.7.0-before-2.7.1-acme-eab-mac-key-disclosure-via-sanitized-configuration"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:37.600Z"}}},"related_cves":[{"value":"CVE-2026-115363","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:476d42e7-4fb4-44fb-b67a-42c348828efd","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115363","advisory_id":"476d42e7-4fb4-44fb-b67a-42c348828efd","event_types":["advisory"],"published_at":"2026-10-25T14:43:22.088387+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:37.6+00:00","detail_url":"/events/52325"}]}},{"id":52796,"cve_ids":["CVE-2026-115361"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial","summary":"OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.","evidence":"cve:CVE-2026-115361","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115361","aliases":["CVE-2026-115361"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:36.151Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-hr5j-3j78-4vh2","https://www.vulncheck.com/advisories/openbao-before-2.6.3-acl-bypass-via-dropped-templated-policy-denial"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:36.151Z"}}},"related_cves":[{"value":"CVE-2026-115361","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:29780990-a9d7-4716-afc3-cb85e2a6a848","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115361","advisory_id":"29780990-a9d7-4716-afc3-cb85e2a6a848","event_types":["advisory"],"published_at":"2026-10-25T14:43:20.992615+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:36.151+00:00","detail_url":"/advisories/advisory%3A29780990-a9d7-4716-afc3-cb85e2a6a848","group":{"id":"advisory:29780990-a9d7-4716-afc3-cb85e2a6a848","revision":1,"primary_event_id":52324,"change":"published","superseded_by":[],"changed":{"id":52324,"cve_ids":["CVE-2026-115361"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial","summary":"OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.","evidence":"cve:CVE-2026-115361","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115361","aliases":["CVE-2026-115361"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:36.151Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-hr5j-3j78-4vh2","https://www.vulncheck.com/advisories/openbao-before-2.6.3-acl-bypass-via-dropped-templated-policy-denial"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:36.151Z"}}},"related_cves":[{"value":"CVE-2026-115361","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:29780990-a9d7-4716-afc3-cb85e2a6a848","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115361","advisory_id":"29780990-a9d7-4716-afc3-cb85e2a6a848","event_types":["advisory"],"published_at":"2026-10-25T14:43:20.992615+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:36.151+00:00","detail_url":"/events/52324"},"members":[{"id":52324,"cve_ids":["CVE-2026-115361"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial","summary":"OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.","evidence":"cve:CVE-2026-115361","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115361","aliases":["CVE-2026-115361"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:36.151Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-hr5j-3j78-4vh2","https://www.vulncheck.com/advisories/openbao-before-2.6.3-acl-bypass-via-dropped-templated-policy-denial"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:36.151Z"}}},"related_cves":[{"value":"CVE-2026-115361","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:29780990-a9d7-4716-afc3-cb85e2a6a848","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115361","advisory_id":"29780990-a9d7-4716-afc3-cb85e2a6a848","event_types":["advisory"],"published_at":"2026-10-25T14:43:20.992615+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:36.151+00:00","detail_url":"/events/52324"}]}},{"id":52795,"cve_ids":["CVE-2026-115362"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.","evidence":"cve:CVE-2026-115362","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115362","aliases":["CVE-2026-115362"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:36.857Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-expired-approle-secretid-authentication-bypass"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:36.857Z"}}},"related_cves":[{"value":"CVE-2026-115362","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:92d4055a-bc4d-4778-a6ea-9dcd5fa755bf","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115362","advisory_id":"92d4055a-bc4d-4778-a6ea-9dcd5fa755bf","event_types":["advisory"],"published_at":"2026-10-25T14:43:20.296334+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:36.857+00:00","detail_url":"/advisories/advisory%3A92d4055a-bc4d-4778-a6ea-9dcd5fa755bf","group":{"id":"advisory:92d4055a-bc4d-4778-a6ea-9dcd5fa755bf","revision":1,"primary_event_id":52323,"change":"published","superseded_by":[],"changed":{"id":52323,"cve_ids":["CVE-2026-115362"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.","evidence":"cve:CVE-2026-115362","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115362","aliases":["CVE-2026-115362"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:36.857Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-expired-approle-secretid-authentication-bypass"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:36.857Z"}}},"related_cves":[{"value":"CVE-2026-115362","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:92d4055a-bc4d-4778-a6ea-9dcd5fa755bf","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115362","advisory_id":"92d4055a-bc4d-4778-a6ea-9dcd5fa755bf","event_types":["advisory"],"published_at":"2026-10-25T14:43:20.296334+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:36.857+00:00","detail_url":"/events/52323"},"members":[{"id":52323,"cve_ids":["CVE-2026-115362"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.","evidence":"cve:CVE-2026-115362","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115362","aliases":["CVE-2026-115362"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:36.857Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-expired-approle-secretid-authentication-bypass"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:36.857Z"}}},"related_cves":[{"value":"CVE-2026-115362","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:92d4055a-bc4d-4778-a6ea-9dcd5fa755bf","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115362","advisory_id":"92d4055a-bc4d-4778-a6ea-9dcd5fa755bf","event_types":["advisory"],"published_at":"2026-10-25T14:43:20.296334+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:36.857+00:00","detail_url":"/events/52323"}]}},{"id":52794,"cve_ids":["CVE-2026-115359"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.","evidence":"cve:CVE-2026-115359","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115359","aliases":["CVE-2026-115359"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:34.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-5v22-543h-wg96","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-role-based-rate-limit-quota-bypass-via-request-parsing"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:34.716Z"}}},"related_cves":[{"value":"CVE-2026-115359","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:48c430b4-c214-4cbe-9919-6f39fafc5178","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115359","advisory_id":"48c430b4-c214-4cbe-9919-6f39fafc5178","event_types":["advisory"],"published_at":"2026-10-25T14:43:19.340484+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:34.716+00:00","detail_url":"/advisories/advisory%3A48c430b4-c214-4cbe-9919-6f39fafc5178","group":{"id":"advisory:48c430b4-c214-4cbe-9919-6f39fafc5178","revision":1,"primary_event_id":52322,"change":"published","superseded_by":[],"changed":{"id":52322,"cve_ids":["CVE-2026-115359"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.","evidence":"cve:CVE-2026-115359","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115359","aliases":["CVE-2026-115359"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:34.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-5v22-543h-wg96","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-role-based-rate-limit-quota-bypass-via-request-parsing"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:34.716Z"}}},"related_cves":[{"value":"CVE-2026-115359","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:48c430b4-c214-4cbe-9919-6f39fafc5178","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115359","advisory_id":"48c430b4-c214-4cbe-9919-6f39fafc5178","event_types":["advisory"],"published_at":"2026-10-25T14:43:19.340484+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:34.716+00:00","detail_url":"/events/52322"},"members":[{"id":52322,"cve_ids":["CVE-2026-115359"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.","evidence":"cve:CVE-2026-115359","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115359","aliases":["CVE-2026-115359"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:34.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-5v22-543h-wg96","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-role-based-rate-limit-quota-bypass-via-request-parsing"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:34.716Z"}}},"related_cves":[{"value":"CVE-2026-115359","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:48c430b4-c214-4cbe-9919-6f39fafc5178","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115359","advisory_id":"48c430b4-c214-4cbe-9919-6f39fafc5178","event_types":["advisory"],"published_at":"2026-10-25T14:43:19.340484+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:34.716+00:00","detail_url":"/events/52322"}]}},{"id":52793,"cve_ids":["CVE-2026-115358"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters","summary":"OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.","evidence":"cve:CVE-2026-115358","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"openbao","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115358","aliases":["CVE-2026-115358"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/sdk/v2","defaultStatus":"unaffected"},{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","packageName":"github.com/openbao/openbao/sdk/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:34.006Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-8xxq-mq9m-xmhw","https://www.vulncheck.com/advisories/openbao-before-2.6.3-sensitive-data-leak-in-audit-log-via-malformed-parameters"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:34.006Z"}}},"related_cves":[{"value":"CVE-2026-115358","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8b33bcd9-f379-4ec7-8486-332217070d86","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115358","advisory_id":"8b33bcd9-f379-4ec7-8486-332217070d86","event_types":["advisory"],"published_at":"2026-10-25T14:42:48.186776+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:34.006+00:00","detail_url":"/advisories/advisory%3A8b33bcd9-f379-4ec7-8486-332217070d86","group":{"id":"advisory:8b33bcd9-f379-4ec7-8486-332217070d86","revision":1,"primary_event_id":52321,"change":"published","superseded_by":[],"changed":{"id":52321,"cve_ids":["CVE-2026-115358"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters","summary":"OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.","evidence":"cve:CVE-2026-115358","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"openbao","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115358","aliases":["CVE-2026-115358"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/sdk/v2","defaultStatus":"unaffected"},{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","packageName":"github.com/openbao/openbao/sdk/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:34.006Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-8xxq-mq9m-xmhw","https://www.vulncheck.com/advisories/openbao-before-2.6.3-sensitive-data-leak-in-audit-log-via-malformed-parameters"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:34.006Z"}}},"related_cves":[{"value":"CVE-2026-115358","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8b33bcd9-f379-4ec7-8486-332217070d86","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115358","advisory_id":"8b33bcd9-f379-4ec7-8486-332217070d86","event_types":["advisory"],"published_at":"2026-10-25T14:42:48.186776+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:34.006+00:00","detail_url":"/events/52321"},"members":[{"id":52321,"cve_ids":["CVE-2026-115358"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters","summary":"OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.","evidence":"cve:CVE-2026-115358","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"openbao","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115358","aliases":["CVE-2026-115358"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/sdk/v2","defaultStatus":"unaffected"},{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.3","versionType":"semver"},{"status":"unaffected","version":"2.6.3","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","packageName":"github.com/openbao/openbao/sdk/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:34.006Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-8xxq-mq9m-xmhw","https://www.vulncheck.com/advisories/openbao-before-2.6.3-sensitive-data-leak-in-audit-log-via-malformed-parameters"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:34.006Z"}}},"related_cves":[{"value":"CVE-2026-115358","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8b33bcd9-f379-4ec7-8486-332217070d86","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115358","advisory_id":"8b33bcd9-f379-4ec7-8486-332217070d86","event_types":["advisory"],"published_at":"2026-10-25T14:42:48.186776+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:34.006+00:00","detail_url":"/events/52321"}]}},{"id":52791,"cve_ids":["CVE-2026-115357"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.","evidence":"cve:CVE-2026-115357","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115357","aliases":["CVE-2026-115357"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:33.290Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-q74w-hv5x-6hxf","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-improper-audit-logging-of-root-generation-and-rekey-responses"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:33.290Z"}}},"related_cves":[{"value":"CVE-2026-115357","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:098c56a7-c38d-4b32-be0c-ff5b3cc28b23","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115357","advisory_id":"098c56a7-c38d-4b32-be0c-ff5b3cc28b23","event_types":["advisory"],"published_at":"2026-10-25T14:42:46.888893+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:33.29+00:00","detail_url":"/advisories/advisory%3A098c56a7-c38d-4b32-be0c-ff5b3cc28b23","group":{"id":"advisory:098c56a7-c38d-4b32-be0c-ff5b3cc28b23","revision":1,"primary_event_id":52319,"change":"published","superseded_by":[],"changed":{"id":52319,"cve_ids":["CVE-2026-115357"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.","evidence":"cve:CVE-2026-115357","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115357","aliases":["CVE-2026-115357"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:33.290Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-q74w-hv5x-6hxf","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-improper-audit-logging-of-root-generation-and-rekey-responses"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:33.290Z"}}},"related_cves":[{"value":"CVE-2026-115357","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:098c56a7-c38d-4b32-be0c-ff5b3cc28b23","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115357","advisory_id":"098c56a7-c38d-4b32-be0c-ff5b3cc28b23","event_types":["advisory"],"published_at":"2026-10-25T14:42:46.888893+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:33.29+00:00","detail_url":"/events/52319"},"members":[{"id":52319,"cve_ids":["CVE-2026-115357"],"payload":{"kind":"advisory","title":"OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses","summary":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.","evidence":"cve:CVE-2026-115357","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-115357","aliases":["CVE-2026-115357"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"0","lessThan":"2.6.4","versionType":"semver"},{"status":"unaffected","version":"2.6.4","versionType":"semver"},{"status":"affected","version":"2.7.0","lessThan":"2.7.1","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/openbao/openbao/v2","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:13:33.290Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-q74w-hv5x-6hxf","https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-improper-audit-logging-of-root-generation-and-rekey-responses"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:13:33.290Z"}}},"related_cves":[{"value":"CVE-2026-115357","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:098c56a7-c38d-4b32-be0c-ff5b3cc28b23","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115357","advisory_id":"098c56a7-c38d-4b32-be0c-ff5b3cc28b23","event_types":["advisory"],"published_at":"2026-10-25T14:42:46.888893+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:13:33.29+00:00","detail_url":"/events/52319"}]}}],"next_after":64610,"next_before":52791}