Token Renewal Vulnerability in OpenBao Affects Kubernetes Auth Method

CVE-2026-115356

What is CVE-2026-115356?

OpenBao versions prior to 2.6.4 and 2.7.x before 2.7.1 are susceptible to a token renewal vulnerability within the Kubernetes Auth method. The flaw allows an authenticated attacker to continue renewing tokens without verifying the validity of the original service account token, potentially leading to unauthorized access even after the associated Kubernetes service account has been deleted. This poses a significant risk for maintaining proper access controls and should be addressed to prevent the exploitation of long-term access.

References