openbao vulnerabilities

CVEs per yearBy the year they were published

1. 202514
2. 202630

Newest CVEs

• CVE-2026-115369

  OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs

  openbao · openbao

  Low2.1
• CVE-2026-115366

  OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

  openbao · openbao

  Low2.0
• CVE-2026-115365

  OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

  openbao · openbao

  High7.5
• CVE-2026-115364

  OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

  openbao · openbao

  Low2.1
• CVE-2026-115363

  OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

  openbao · openbao

  Low2.1
• CVE-2026-115362

  OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

  openbao · openbao

  Low2.1
• CVE-2026-115361

  OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

  openbao · openbao

  Low2.1
• CVE-2026-115360

  OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

  openbao · openbao

  Medium5.3
• CVE-2026-115359

  OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing

  openbao · openbao

  Medium6.3
• CVE-2026-115358

  OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

  openbao · openbao

  Low2.0