Authentication Bypass in OpenBao by OpenBao

CVE-2026-115362

What is CVE-2026-115362?

OpenBao versions prior to 2.6.4 and those in the 2.7.x series before 2.7.1 are susceptible to an authentication bypass due to inadequate handling of Secret ID expiration in the AppRole authentication method. This oversight permits an attacker in possession of an expired Secret ID to authenticate successfully and retain access privileges beyond the intended time limit, until these IDs are periodically purged. Such vulnerabilities can significantly compromise the security posture of affected systems, emphasizing the need for prompt remediation.

References