Aller au contenu
en Se connecter
2.1 Faible

CVE-2026-115363 OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the…

Description

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.

Produits et versions touchés

Produit Versions touchées Corrigé en
openbao 2.7 2.7.0 → < 2.7.1 2.7.1
openbao 2.6 premières → < 2.6.4 2.6.4
openbao 2.2 2.2.0 → < 2.6.4 2.6.4

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de openbao

Les 43 CVE de openbao →
CVE-2026-115369 OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a… 2.1 Faible CVE-2026-115366 OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged… 2.0 Faible CVE-2026-115365 OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal 7.5 Élevée CVE-2026-115364 OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by… 2.1 Faible
Suivre cette CVE