PT-2026-42808 · Openbao+1 · Openbao+1
CVE-2026-46358
·
Published
2026-05-21
·
Updated
2026-08-17
CVSS v2.0
6.5
Medium
| Vector | AV:L/AC:L/Au:M/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
OpenBao versions prior to 2.5.4
Description
The inline auth functionality incorrectly redacts audit log entries. This causes non-auth headers to be removed while auth-related headers are retained in cleartext. Exploitation requires an attacker to have compromised access to the audit device.
Recommendations
Update to version 2.5.4.
Review leaked source authentication material and rotate it as appropriate.
Exploit
Fix
DoS
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openbao
Red Os