https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:14:54 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-08725 bdu:2026-08725 https://cve.radiocsirt.org/vuln/bdu:2026-08725 https://cve.radiocsirt.org/vuln/bit-openbao-2026-39388 <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao&#39;s Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request&#39;s presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates.</p> <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao&#39;s Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request&#39;s presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates.</p> https://cve.radiocsirt.org/vuln/bit-openbao-2026-39388 https://cve.radiocsirt.org/vuln/euvd-2026-292275 EUVD-2026-292275 https://cve.radiocsirt.org/vuln/euvd-2026-292275 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39388 <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao&#39;s Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request&#39;s presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates.</p> <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao&#39;s Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request&#39;s presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39388 https://cve.radiocsirt.org/vuln/ghsa-7ccv-rp6m-rffr <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Background</p> <p>OpenBao&#39;s Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request&#39;s presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information.</p> <p>### Impact</p> <p>Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor.</p> <p>This vulnerability is originally from HashiCorp Vault.</p> <p>### Patches</p> <p>This has been addressed in v2.5.3.</p> <p>### Workarounds</p> <p>Ensure privileged roles are tightly scoped to single certificates.</p> <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Background</p> <p>OpenBao&#39;s Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request&#39;s presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information.</p> <p>### Impact</p> <p>Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor.</p> <p>This vulnerability is originally from HashiCorp Vault.</p> <p>### Patches</p> <p>This has been addressed in v2.5.3.</p> <p>### Workarounds</p> <p>Ensure privileged roles are tightly scoped to single certificates.</p> https://cve.radiocsirt.org/vuln/ghsa-7ccv-rp6m-rffr https://cve.radiocsirt.org/vuln/opensuse-su-2026:10594-1 <p>openbao-2.5.3-1.1 on GA media</p> <p>openbao-2.5.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10594-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1189 <p>Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um einen SQL-Injection Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um einen SQL-Injection Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1189