PKI Role Enforcement Flaw in OpenBao by OpenBao
CVE-2026-115369

2.1LOW

Key Information:

Vendor

Openbao

Status
Openbao
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115369?

The OpenBao software versions prior to 2.6.2 contain a vulnerability that fails to properly enforce the allowed_ip_sans_cidr restrictions on IP Subject Alternative Names (SANs) extracted from Certificate Signing Requests (CSRs) when the use of CSR SANs is enabled. This flaw allows authenticated users with the 'sign' permission to submit a CSR containing an out-of-range IP SAN, facilitating the unauthorized issuance of CA-signed certificates for IP addresses that should not be allowed. This can lead to potential security breaches and misuse of the certificate authority capabilities.

Affected Version(s)

openbao 2.5.0 < 2.6.2

openbao 2.6.2

References

https://github.com/openbao/openbao/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openbao-2.5.0-before...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AkshayJainG
.