OP
Product
openbao
48
CVEs
0
On KEV
9.8
Max CVSS
12
New 30D
Severity mix
Critical 3High 12Medium 19Low 14
Watch
Add openbao to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-115359 New | 3.7 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing Affected: before 2.6.4; 2.7.0 before 2.7.1 |
| CVE-2025-54999 | 3.7 | Aug 9 | OpenBao: Timing Side-Channel in Userpass Auth Method Affected: >= 0.1.0, < 2.3.2 |
| CVE-2026-115363 New | 3.3 | Oct 22 | OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration Affected: 2.2.0 before 2.6.4; 2.7.0 before 2.7.1 |
| CVE-2026-39388 | 3.1 | Apr 21 | OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate Affected: < 2.5.3 |
| CVE-2026-40264 | 2.7 | Apr 21 | OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation Affected: < 2.5.3 |
| CVE-2026-115366 New | 2.6 | Oct 22 | OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs Affected: 2.3.0 before 2.6.3 |
| CVE-2026-77285 | 2.4 | Sep 23 | OpenBao Agent Writes Secrets to Stdout Affected: < 2.6.0 |
| CVE-2026-55775 | 2.3 | Sep 15 | OpenBao's System Backend allows Unauthorized Management of the containing Namespace Affected: < 2.5.5 |
| CVE-2026-115369 New | 2.2 | Oct 22 | OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs Affected: 2.5.0 before 2.6.2 |
| CVE-2026-115364 New | 2.2 | Oct 22 | OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints Affected: before 2.6.3 |
| CVE-2026-115362 New | 2.2 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass Affected: before 2.6.4; 2.7.0 before 2.7.1 |
| CVE-2026-115357 New | 2.2 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses Affected: before 2.6.4; 2.7.0 before 2.7.1 |
| CVE-2026-55774 | 2.1 | Sep 15 | OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 Affected: < 2.5.5 |
| CVE-2026-115358 New | 2.0 | Oct 22 | OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters Affected: before 2.6.3; before 2.6.3; 2.7.0 before 2.7.1 |
Showing 14