CVE-2026-115356Medium· 5.4▾ SunlitOpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep re…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.
openbao < 2.6.4openbao >= 2.7.0 < 2.7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115362Low· 2.2OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass
CVE-2026-115365Medium· 6.6OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
CVE-2026-115366Low· 2.6OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs
CVE-2026-115369Low· 2.2OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
CVE-2026-115361Medium· 4.1OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
CVE-2026-115363Low· 3.3OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration