CVE-2026-46358
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
OpenBao before version 2.5.4 has a vulnerability in the inline auth functionality that incorrectly redacts audit log entries, removing non-auth headers and retaining auth-related headers in cleartext. This requires an attacker to compromise access to the audit device.
Risk Assessment
The risk includes potential disclosure of authentication material in audit logs, which could lead to unauthorized access if logs are intercepted.
Recommendation
Upgrade to version 2.5.4 or later. Operators should review leaked source authentication material and rotate it as appropriate.
Original NVD description (English source)
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.