OpenBao vulnerabilities

OpenBao is an identity-based secrets management system. Prior to version 2.5.3, when the initial namespace deletion fails, subsequent retries do not properly remove all data before marking the namespace as deleted.

OpenBao prior to version 2.5.2 does not prompt for user confirmation when logging in via JWT/OIDC with a role set to `callback_mode=direct`. This allows an attacker to perform remote phishing by having the victim visit a URL and automatically log into the attacker's session.

OpenBao before version 2.5.4 has a vulnerability in the Kerberos auth method where the response to a GET request or with an Authorization: Negotiate header includes a logical.Auth object in addition to an error message. This results in tokens being created with default policy, default TTL, and no entity information, hidden by the error message. These tokens are not accessible to the caller or outside sys/raw.

OpenBao prior to version 2.5.4 has a vulnerability in namespaces where a tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented sys/revoke and sys/renew endpoints.

OpenBao before version 2.5.4 has a vulnerability in the inline auth functionality that incorrectly redacts audit log entries, removing non-auth headers and retaining auth-related headers in cleartext. This requires an attacker to compromise access to the audit device.

OpenBao versions prior to 2.5.2 with OIDC/JWT authentication enabled and a role configured with `callback_mode=direct` are vulnerable to XSS via the `error_description` parameter on the failed authentication page. An attacker can steal the token used in the Web UI by a victim.