Low severity · published Sep 23, 2026
CVE-2026-77285
OpenBao Agent Writes Secrets to Stdout
2.4
CVSS
0.2%
EPSS
No
On KEV
Description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openbao · openbao
< 2.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77285
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77285
github.com
https://github.com/openbao/openbao/commit/90272575e5f58b3883fbb0ccb2238e9285722d1a
github.com
https://github.com/openbao/openbao/commit/ee3aa4aff72c5176cf02af21eac7158899080878
github.com
https://github.com/openbao/openbao/pull/3494
github.com
https://github.com/openbao/openbao/pull/3495
github.com
https://github.com/openbao/openbao/releases/tag/v2.6.0
github.com
https://github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h
More from openbao
9.8
CVE-2024-2048
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate
9.2
CVE-2026-63132
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
9.1
CVE-2025-54997
OpenBao: Privileged Operator May Execute Code on the Underlying Host
8.8
CVE-2024-7594
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default
8.3
CVE-2026-33757
OpenBao lacks user confirmation for OIDC direct callback mode