CVE-2026-115360 openbao CVE debrief

Who should care

Defenders responsible for OpenBao deployments, particularly those using the OIDC identity provider UI, should assess exposure and prioritize verification and remediation efforts. This includes OpenBao administrators, security teams, and IT professionals responsible for identity and access management. Additionally, organizations that rely on OpenBao for authentication and authorization should also be aware of this vulnerability and take necessary steps to  

Why it matters

Defenders should care about CVE-2026-115360 because it allows attackers to craft OIDC links that redirect unauthenticated OpenBao users to attacker-controlled destinations, enabling phishing or credential theft. OpenBao deployments using the OIDC identity provider UI should verify their version and configuration to prevent exploitation.

• Phishing attacks via crafted OIDC links
• Credential theft through redirect to attacker-controlled destinations
• Potential for unauthorized access to OpenBao instances
• Need for verification of OpenBao version and OIDC configuration

Technical summary

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider. This vulnerability affects unauthenticated users and allows attackers to craft OIDC links that redirect users to attacker-controlled destinations, potentially leading to phishing or credential theft. The vulnerability arises from inadequate validation of redirect URLs in the OIDC identity provider UI, which enables attackers to manipulate the redirect targets. To mitigate this vulnerability, it is essential to upgrade to OpenBao version 2.6.3 or later and review OIDC configurations.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenBao version 2.6.3 or later to prevent open redirect attacks via the OIDC identity provider UI.

Recommended defensive actions

• Verify OpenBao version and upgrade to 2.6.3 or later if necessary
• Review and restrict OIDC identity provider UI access to authenticated users
• Monitor for suspicious OIDC link activity
• Implement additional security measures to prevent phishing attacks
• Conduct a thorough review of OpenBao configurations and OIDC settings to ensure secure deployment
• Perform vulnerability scanning and penetration testing to identify potential weaknesses
• Develop and implement incident response plans in case of potential exploitation

Evidence notes

The CVE record and source item provide details on the open redirect vulnerability in OpenBao before 2.6.3. The vendor has released a security advisory (GHSA-2cjw-94fw-wqjx) and a third-party advisory is also available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.