CVE-2026-115356 openbao CVE debrief

Who should care

OpenBao users, especially those using Kubernetes Auth method, should assess exposure and prioritize remediation. The issue is particularly concerning for users of the Kubernetes Auth method. OpenBao users should verify token renewal processes and service account token validity. Remediation involves upgrading to OpenBao 2.6.4 or 2.7.1.

Why it matters

OpenBao vulnerability allows authenticated attackers to renew Kubernetes Auth method tokens after revocation, persisting access. Assess exposure, prioritize remediation, and verify token renewal processes.

• Authenticated attackers can persist access after Kubernetes service account deletion
• Token renewal processes require verification
• Remediation priority for OpenBao users
• Exposure assessment required for Kubernetes Auth method usage

Technical summary

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 does not verify service account token validity when renewing tokens issued by the Kubernetes Auth method. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted. This issue requires immediate attention from OpenBao users, especially those using the Kubernetes Auth method. The vulnerability allows authenticated attackers to renew Kubernetes Auth method tokens after revocation, persisting access. OpenBao users should assess exposure and prioritize remediation.

Defensive priority

Medium priority for OpenBao users, especially those using Kubernetes Auth method

Recommended defensive actions

• Assess OpenBao deployment for Kubernetes Auth method usage
• Verify token renewal processes and service account token validity
• Remediate by upgrading to OpenBao 2.6.4 or 2.7.1
• Monitor for suspicious token renewal activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability. Vendor advisories and third-party advisories offer additional context. The vulnerability allows authenticated attackers to renew Kubernetes Auth method tokens after revocation, persisting access. OpenBao users should assess exposure and prioritize remediation. The issue is particularly concerning for users of the Kubernetes Auth method. Evidence is limited to CVE Program and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.