Improper access control in OpenBao - CVE-2026-46405
Published: May 21, 2026
Vulnerability identifier: #VU132077
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-46405
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper access control in the Kerberos auth method GET handler when handling GET requests or requests with an Authorization: Negotiate header. A remote attacker can send a specially crafted request to cause a denial of service.
The issue creates authentication tokens that are not accessible to the caller and can accumulate in storage.
Affected software
OpenBao
Fedora
openbao
Fedora
openbao
How to mitigate CVE-2026-46405
Install security update from vendor's website.
OpenBao - update to 2.5.4
openbao - addressed in versions 2.5.4-1.el8, 2.5.4-1.el9, 2.5.4-1.el10_2, 2.5.4-1.el10_3, 2.5.4-1.fc42, 2.5.4-1.fc43
openbao - addressed in versions 2.5.4-1.el8, 2.5.4-1.el9, 2.5.4-1.el10_2, 2.5.4-1.el10_3, 2.5.4-1.fc42, 2.5.4-1.fc43