Information Disclosure Vulnerability in OpenBao by OpenBao
CVE-2026-115363

2.1LOW

Key Information:

Vendor

Openbao

Status
Openbao
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115363?

OpenBao versions 2.2.0 through 2.6.4 and 2.7.0 prior to 2.7.1 are susceptible to an information disclosure vulnerability. This flaw exposes the tls_acme_eab_mac_key value via the sanitized configuration endpoint. Exploiting this vulnerability allows unauthorized users to access the ACME External Account Binding MAC key used for TLS certificates, potentially enabling them to compromise the operator’s ACME account and bind to sensitive TLS listener certificates.

Affected Version(s)

openbao 2.2.0 < 2.6.4

openbao 2.7.0 < 2.7.1

openbao 2.6.4

References

https://github.com/openbao/openbao/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openbao-2.2.0-before...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Luiggi33
opensec-intelligence
.