Improper Authentication in OpenBao - CVE-2026-39388

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU126699

Improper Authentication in OpenBao - CVE-2026-39388

Published: April 21, 2026


Vulnerability identifier: #VU126699
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39388
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to modify token renewal behavior and extend the lifetime of dynamic leases.

The vulnerability exists due to improper certificate binding validation in the certificate authentication method when processing token renewal requests with disable_binding=true. A remote privileged user can present a sibling certificate and key signed by the same CA to modify token renewal behavior and extend the lifetime of dynamic leases.

Exploitation requires knowledge of the original token or its accessor.


Affected software

OpenBao
Fedora
openbao

How to mitigate CVE-2026-39388

Install security update from vendor's website.

OpenBao - update to 2.5.3
openbao - addressed in versions 2.5.3-1.el8, 2.5.3-1.el9, 2.5.3-1.el10_1, 2.5.3-1.el10_2, 2.5.3-1.el10_3, 2.5.3-1.fc42, 2.5.3-1.fc43, 2.5.3-1.fc44

External References

Related Security Bulletins