CVE-2026-115362: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

Severity: low (CVSS 2.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-29
Weakness: CWE-613

Description

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.

Affected products

openbao: before 2.6.4; from 2.7.0 before 2.7.1 — fixed in 2.6.4, 2.7.1

How to fix

Upgrade to a fixed version: openbao 2.6.4, 2.7.1. Check the vendor advisory for mitigations.

References

https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph
https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-expired-approle-secretid-authentication-bypass

Get alerted when CVE-2026-115362 or the next vulnerability affects your stack