---
id: CVE-2026-46405
title: OpenBao is an open source identity-based secrets management system
summary: >-
  OpenBao is an open source identity-based secrets management system. Prior to
  version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when
  an `Authorization: Negotiate` header is supplied, the response is includes a
  `log…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-770
vendor: openbao
product: github.com/openbao/openbao
affected:
  - github.com/openbao/openbao < 2.5.4
patched:
  - github.com/openbao/openbao 2.5.4
published: '2026-08-07'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46405'
references:
  - url: >-
      https://github.com/openbao/openbao/commit/0d82e0a5a3b6a93e8087bcbaf0b11326c12d4f4d
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3150'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.5.4'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-7j6w-vvw2-5f9c'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao'
tags:
  - nvd
  - osv
  - go
epss: 0.00364
epssPercentile: 0.30214
aliases:
  - GHSA-7j6w-vvw2-5f9c
  - BIT-openbao-2026-46405
  - GO-2026-5225
ecosystem: go
ingestedAt: '2026-08-17T19:20:55.561Z'
---

## Overview

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the response is includes a `logical.Auth` object in addition to an error message. This results in tokens being created with only the default policy, default TTL, and no entity information, which are hidden by the returned error message. No access to these tokens by the caller occurs and the authentication token is not ever made accessible outside of `sys/raw`. This is fixed in OpenBao v2.5.4. As a workaround, users may set a rate limit quota to limit the creation of these paths. As the path is unauthenticated, it isn't possible to deny access to it.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-46405)

Affected packages:

- `github.com/openbao/openbao < 2.5.4`

Patched in:

- `github.com/openbao/openbao 2.5.4`

Source: https://osv.dev/vulnerability/GHSA-7j6w-vvw2-5f9c