CVE-2026-115369 openbao CVE debrief

Who should care

Defenders responsible for OpenBao instances, especially those with sign permission exposed to authenticated callers, should assess exposure and prioritize remediation. This includes verifying instance versions and configurations, restricting sign permission, and monitoring for suspicious activity. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to protect Open

Why it matters

Defenders should care about CVE-2026-115369 because it allows authenticated callers with sign permission to bypass IP SAN restrictions in OpenBao 2.5.0 before 2.6.2, potentially leading to unauthorized IP address usage and certificate impersonation. Defenders responsible for OpenBao instances should assess exposure, prioritize remediation, and verify instance versions and configurations.

• Potential unauthorized IP address usage through CA-signed certificates
• Increased risk of certificate impersonation or unauthorized access
• Need for verification of OpenBao instance versions and configurations
• Priority for applying patches or updates to OpenBao instances

Technical summary

OpenBao 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs. This vulnerability allows for potential unauthorized IP address usage and certificate impersonation. Defenders should prioritize verifying and remediating OpenBao instances with versions between 2.5.0 and 2.6.2.

Defensive priority

Defenders should prioritize verifying and remediating OpenBao instances with versions between 2.5.0 and 2.6.2, especially those with sign permission exposed to authenticated callers.

Recommended defensive actions

• Verify OpenBao instance versions and configurations to identify potential exposure
• Restrict sign permission to necessary roles and ensure proper IP SAN validation
• Monitor for suspicious CSR submissions and CA-signed certificate issuance
• Apply patches or updates to OpenBao instances as soon as possible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in OpenBao 2.5.0 before 2.6.2. Vendor advisories and third-party advisories offer additional context. Evidence is limited to public sources and may not be comprehensive. Defenders should verify OpenBao instance versions and configurations to identify potential exposure and monitor for suspicious CSR submissions and CA-signed certificate issuance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.