CVE-2026-115362

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1

Description The AppRole authentication method fails to verify the expiration of the Secret ID during use. This allows an attacker possessing an expired Secret ID that has not yet been removed by the periodic tidy process to authenticate and gain unauthorized access beyond the intended Time To Live (TTL), which is the duration for which a token or secret is valid.

Recommendations Update OpenBao to version 2.6.4 or later. Update OpenBao to version 2.7.1 or later.