Advisories · Technology
openbao.
Every CVE that names openbao among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.1 Low
OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
- openbao
- Broken access control
- CVSS 2.0 Low
OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs
- openbao
- Broken access control
- CVSS 7.5 High
OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
- openbao
- Broken access control
- CVSS 2.1 Low
OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints
- openbao
- Broken access control
- CVSS 2.1 Low
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
- openbao
- CWE-212
- CVSS 2.1 Low
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass
- openbao
- Authentication bypass
- CVSS 2.1 Low
OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
- openbao
- Broken access control
- CVSS 5.3 Medium
OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI
- openbao
- Open redirect
- CVSS 6.3 Medium
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
- openbao
- CWE-799
- CVSS 2.0 Low
OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters
- openbao
- Information disclosure
- CVSS 2.1 Low
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses
- openbao
- CWE-778
- CVSS 5.3 Medium
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
- openbao
- Authentication bypass