CVE-2026-115356

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1

Description When renewing a token issued by the Kubernetes Auth method, the system fails to verify if the service account token used for the initial authentication remains valid. This allows an authenticated attacker to continuously renew tokens to maintain persistent access even after the associated Kubernetes service account has been deleted.

Recommendations Update OpenBao to version 2.6.4 or later. Update OpenBao to version 2.7.1 or later.