Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default

OpenBao lacks user confirmation for OIDC direct callback mode

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

OpenBao's Namespace Deletion May Not Delete Data Properly

OpenBao leaks HTTPRawBody in Audit Logs

OpenBao vulnerable to denial of service via malicious JSON request processing

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion…

OpenBao Privileged Operator Identity Group Root Escalation

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao: LDAPi ldaputil (wrong escape func)

OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads…

OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

OpenBao allows SQL Injection in PostgreSQL database secrets engine

OpenBao and Vault Leak []byte Fields in Audit Logs

OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao Agent Writes Secrets to Stdout

OpenBao's System Backend allows Unauthorized Management of the containing Namespace

OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs

OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters