CVE-2026-63131

OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

In OpenBao prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching; in PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains; in SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected.

OpenBao is an identity-based secrets management system. Prior to version 2.5.3, when the initial namespace deletion fails, subsequent retries do not properly remove all data before marking the namespace as deleted.

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.

OpenBao prior to version 2.5.2 does not prompt for user confirmation when logging in via JWT/OIDC with a role set to `callback_mode=direct`. This allows an attacker to perform remote phishing by having the victim visit a URL and automatically log into the attacker's session.

OpenBao prior to 2.5.5 has a vulnerability where an authenticated caller with write access to transit/keys/* can terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. A mutex double-unlock error leads to a panic, no HTTP response, and denial of service.

OpenBao prior to 2.5.5 allows users granted capabilities on /sys/namespaces/root within a non-root namespace to exploit special handling of the literal root path in namespace canonicalization. ACL checks occur before root canonicalizes to an empty path, so /sys/namespaces/root resolves to the system backend's containing namespace, allowing permitted lookups, deletion, locking, or custom metadata changes against that namespace.

OpenBao prior to 2.5.5 allows a user with access to sys/leases/revoke/:lease_id in one namespace to revoke a lease in another namespace when the foreign lease_id is known. The lease lookup routing in vault/expiration.go lets FetchLeaseInfo and loadEntry resolve lease data outside the request namespace, enabling one tenant to revoke another tenant's lease and underlying credential.

OpenBao prior to 2.5.5 uses EscapeLDAPValue (an RFC 4514 DN escaping function) where RFC 4515 LDAP search-filter escaping is required in GetUserDN. With the LDAP authentication backend configured for Active Directory, an attacker-controlled username containing filter metacharacters can alter the search predicate and select a different directory entry, allowing a token to be associated with another identity and gain access to its secrets.

OpenBao before version 2.5.4 has a vulnerability in the Kerberos auth method where the response to a GET request or with an Authorization: Negotiate header includes a logical.Auth object in addition to an error message. This results in tokens being created with default policy, default TTL, and no entity information, hidden by the error message. These tokens are not accessible to the caller or outside sys/raw.