CVE-2026-115362

EUVD-2026-108287
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
2.2 LOW
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.97%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openbaoopenbao
𝑥
< 2.6.4
CNA
openbaoopenbao
2.7.0 ≤
𝑥
< 2.7.1
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph
https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-expired-approle-secretid-authentication-bypass