CVE-2026-115357 openbao CVE debrief

Who should care

Defenders responsible for OpenBao deployments should assess exposure and verify audit logging configuration to detect potential security incidents. OpenBao operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to ensure proper security measures are in place. Defenders should prioritize verifying OpenBao versions and ensuring proper audit logging configuration to mit

Why it matters

OpenBao vulnerability allows attackers to complete root token generation or rekey operations without corresponding response audit records.

• Defenders may need to verify audit logging configuration to detect potential security incidents.
• OpenBao deployments may require updates to ensure proper audit logging.

Technical summary

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 fails to write response audit entries for unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. This vulnerability allows attackers to complete root token generation or rekey operations without corresponding response audit records. Defenders should prioritize verifying OpenBao versions and ensuring proper audit logging configuration to mitigate potential security incidents. The vulnerability is related to improper audit logging, and defenders should review OpenBao deployments to ensure proper security measures are in place.

Defensive priority

Defenders should prioritize verifying OpenBao versions and ensuring proper audit logging configuration.

Recommended defensive actions

• Verify OpenBao version and ensure proper audit logging configuration
• Review and update OpenBao to version 2.6.4 or 2.7.1 if necessary
• Monitor OpenBao logs for potential security incidents
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in OpenBao before 2.6.4 and 2.7.0 before 2.7.1. The vulnerability is related to improper audit logging of root generation and rekey responses. Defenders should verify audit logging configuration and review OpenBao versions to ensure proper security measures are in place. The source item provides additional context on the vulnerability, and defenders should review it for further information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.