SB20260925265 - Multiple vulnerabilities in OpenBao

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260925265

SB20260925265 - Multiple vulnerabilities in OpenBao

Published: September 25, 2026

Security Bulletin ID SB20260925265
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Inclusion of Sensitive Information in Log Files (CVE-ID: N/A)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper handling of malformed TypeKVPair and TypeHeader parameters in OpenBao plugin audit logging when processing requests containing malformed TypeKVPair or TypeHeader fields. A remote privileged user can send a request containing malformed fields to disclose sensitive information.

User interaction and additional attack preconditions are required for exploitation.


2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain a certificate containing non-validated subject alternative names.

The vulnerability exists due to improper input validation in the PKI ACME certificate issuance functionality when handling ACME certificate requests. A remote attacker can validate an allowed domain and request a certificate containing non-validated subject alternative names to obtain a certificate containing non-validated subject alternative names.

Exploitation requires the PKI ACME feature to be enabled and configured, and the non-validated subject alternative names must be of a type that is not issuable through ACME, such as email addresses.


3) Open redirect (CVE-ID: N/A)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an attacker-controlled website.

The vulnerability exists due to improper URL validation in the OIDC identity provider UI when handling user-supplied redirect targets. A remote attacker can craft a redirect link to redirect users to an attacker-controlled website.

User interaction is required.


4) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass access control restrictions.

The vulnerability exists due to improper authorization in policy evaluation when evaluating policies containing a global explicit wildcard grant and a narrow denial based on a forbidden identity template. A remote privileged user can cause the denial to be dropped and access resources covered by the broader wildcard grant to bypass access control restrictions.

In most cases, the relevant identity metadata is set by an identity provider trusted by OpenBao.


5) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the Agent and Proxy quit endpoints when handling requests without the required X-Vault-Header. A remote privileged user can send a request without the required header to cause a denial of service.

The issue affects Agent and Proxy services configured with require_request_header = true.


6) Path Traversal: \'../filedir\' (CVE-ID: N/A)

CWE-ID: CWE-24 - Path Traversal: \'../filedir\'

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform unauthorized actions across namespaces.

The vulnerability exists due to path traversal in the ACL policy cache when resolving specially crafted policy names. A remote user can attach specially crafted policy names to tokens to perform unauthorized actions across namespaces.

The referenced policies must be present in the in-memory LRU policy cache when the token is created and when it is used.


7) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in the sys/storage/raft/snapshot-force endpoint when replacing Raft storage state. A remote privileged user can replace the plugin catalog with entries for arbitrary binaries to execute arbitrary code.

Only instances using the Raft storage backend are affected. Exploitation requires the instance to subsequently be unsealed.


8) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass ACL deny rules and access protected resources.

The vulnerability exists due to improper authorization in OpenBao ACL policy matching when using non-canonical resource names. A remote user can use case-insensitive, whitespace-trimmed, or path-simplified names to bypass explicit deny grants and access protected resources.

Exploitation requires an ACL policy that uses broad wildcard grants with specific deny grants for excluded resources.


9) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to incorrect authorization in the plugin registration APIs when sending requests to plugin registration APIs from a child namespace. A remote user can update or remove plugin registrations to cause a denial of service.


Remediation

Install update from vendor's website.

References