OpenBao Identity-Based Secrets Management System Vulnerability

CVE-2026-77285

What is CVE-2026-77285?

The OpenBao Agent, up until version 2.6.0, had a vulnerability in its exec rendering mode that allowed sensitive secrets to be written to standard output under certain conditions. If the agent experienced repeated rendering failures, specifically after the number of retries was exceeded, the rendered secrets could be exposed to any process supervisor or local user with access to that output. This flaw underscores the importance of safeguarding sensitive data in applications, highlighting that version 2.6.0 has addressed this security concern.

References