---
id: CVE-2026-115369
title: OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
summary: >-
  OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role
  allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans
  is enabled. Authenticated callers with sign permission can submit a CSR with
  an out-of-range IP …
severity: low
cvss: 2.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: openbao
product: openbao
affected:
  - openbao >= 2.5.0 < 2.6.2
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:13:40.448Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115369'
references:
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-g892-p242-8g86'
    label: GitHub Security Advisory (GHSA-g892-p242-8g86)
  - url: >-
      https://www.vulncheck.com/advisories/openbao-2.5.0-before-2.6.2-pki-allowed-ip-sans-cidr-bypass-via-csr-ip-sans
    label: >-
      VulnCheck Advisory: OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr
      Bypass via CSR IP SANs
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.400Z'
---

## Overview

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.

## Affected

- `openbao >= 2.5.0 < 2.6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.