CVE-2026-115369

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.5.0 through 2.6.1

Description When the use csr sans setting is enabled, the software fails to enforce the allowed ip sans cidr restriction on IP Subject Alternative Names (SANs) extracted from a Certificate Signing Request (CSR). Authenticated users with sign permissions can submit a CSR containing an out-of-range IP SAN to the 'pki/sign/' endpoint to obtain CA-signed certificates for unauthorized IP addresses.

Recommendations Update OpenBao to version 2.6.2 or later.