PT-2026-121538

CVE-2026-115358

Published

2026-10-22

Updated

2026-10-29

Description by

CVSS 3.1

2.0

Low

MetricsAV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3

Description An information disclosure issue exists where attackers can leak sensitive data into audit logs by sending malformed plugin parameters. By submitting requests with malformed TypeKVPair or TypeHeader field values, error messages containing the sensitive input are recorded in the logs.

Recommendations Update to version 2.6.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Cipherboy

Opensec-Intelligence

Vendors

Affected products

Weakness enumeration

CWE-532: Insertion of Sensitive Information into Log File