OpenBao: LDAPi ldaputil (wrong escape func)

OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)

OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

OpenBao TOTP Secrets Engine Enables Code Reuse

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads…

OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

OpenBao Userpass and LDAP User Lockout Bypass

OpenBao allows SQL Injection in PostgreSQL database secrets engine

OpenBao and Vault Leak []byte Fields in Audit Logs

OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial