---
id: CVE-2026-115356
title: >-
  OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token
  Renewal After Revocation
summary: >-
  OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a
  token issued by the Kubernetes Auth method, that the service account token
  originally used to authenticate is still valid. An authenticated attacker can
  keep re…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-613
vendor: openbao
product: openbao
affected:
  - openbao < 2.6.4
  - openbao >= 2.7.0 < 2.7.1
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:13:32.611Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115356'
references:
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-gf3j-hm38-jhh5'
    label: GitHub Security Advisory (GHSA-gf3j-hm38-jhh5)
  - url: >-
      https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-kubernetes-auth-method-token-renewal-after-revocation
    label: >-
      VulnCheck Advisory: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes
      Auth Method Token Renewal After Revocation
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.397Z'
---

## Overview

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.

## Affected

- `openbao < 2.6.4`
- `openbao >= 2.7.0 < 2.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.