What’s Vulnerable › Vulnerabilities

CVE-2026-115356: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-23
• Weakness: CWE-613

Description

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.

Affected products

• openbao: before 2.6.4; from 2.7.0 before 2.7.1 — fixed in 2.6.4, 2.7.1

How to fix

Upgrade to a fixed version: openbao 2.6.4, 2.7.1. Check the vendor advisory for mitigations.

References

• https://github.com/openbao/openbao/security/advisories/GHSA-gf3j-hm38-jhh5
• https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-kubernetes-auth-method-token-renewal-after-revocation

Get alerted when CVE-2026-115356 or the next vulnerability affects your stack