Skip to content
fr Sign in
2.1 Low

CVE-2026-115363 OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the…

Description

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.

Affected products and versions

Product Affected versions Fixed in
openbao 2.7 2.7.0 → < 2.7.1 2.7.1
openbao 2.6 earliest → < 2.6.4 2.6.4
openbao 2.2 2.2.0 → < 2.6.4 2.6.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of openbao

The 43 CVEs of openbao →
CVE-2026-115369 OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a… 2.1 Low CVE-2026-115366 OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged… 2.0 Low CVE-2026-115365 OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal 7.5 High CVE-2026-115364 OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by… 2.1 Low
Track this CVE