{"id":"CVE-2026-77285","aliases":["BIT-openbao-2026-77285","EUVD-2026-85518","GHSA-444v-8vxr-p36h","GO-2026-6554"],"status":"published","title":"OpenBao Agent Writes Secrets to Stdout","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.","severity":{"version":"4.0","score":2.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00165,"percentile":0.05717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2026-09-22T20:36:46Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"Go","package":"github.com/openbao/openbao","fixed_in":["0.0.0-20260714163218-90272575e5f5"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"openbao","fixed_in":["2.6.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20260714163218-90272575e5f5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"last_affected":"1.1.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"openbao","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260714163218-90272575e5f5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"last_affected":"1.1.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260714163218-90272575e5f5"},{"introduced":"0.1.0"}]}]}],"products":[{"vendor":"openbao","product":"openbao"}],"references":[{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h","tags":["x_refsource_CONFIRM","web","advisory"]},{"url":"https://github.com/openbao/openbao/pull/3494","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/openbao/openbao/pull/3495","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/openbao/openbao/commit/90272575e5f58b3883fbb0ccb2238e9285722d1a","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/openbao/openbao/commit/ee3aa4aff72c5176cf02af21eac7158899080878","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/openbao/openbao/releases/tag/v2.6.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-444v-8vxr-p36h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77285","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77285.json","tags":["advisory"]},{"url":"https://github.com/openbao/openbao","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-77285","title":"OpenBao Agent Writes Secrets to Stdout","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.","status":"published","published":"2026-09-23T17:59:13.118Z","modified":"2026-09-23T19:23:54.659Z","cvss":[{"version":"4.0","score":2.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H","level":"low","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-85518","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.","status":"published","published":"2026-09-23T17:59:13Z","modified":"2026-09-23T19:23:54Z","cvss":[{"version":"4.0","score":2.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H","level":"low"}],"updated_at":"2026-11-02T17:28:00.170339Z"}],"ghsa":[{"id":"GHSA-444v-8vxr-p36h","title":"OpenBao Agent Writes Secrets to Stdout","description":"### Impact\n\nDuring certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in `env_template` to stdout. This primarily happens when `num_retries` is met.\n\nThis vulnerability is original to Vault and was reported via the OpenBao security mailing list.\n\n### Patches\n\nThis is addressed in OpenBao v2.6.0 GA.","status":"published","published":"2026-09-22T20:36:46Z","modified":"2026-09-22T20:36:48Z","cvss":[{"version":"4.0","score":2.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:41:20.575159Z"}],"nvd":[{"id":"CVE-2026-77285","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.","status":"published","published":"2026-09-23T19:19:15.18Z","modified":"2026-09-29T19:06:32.333Z","cvss":[{"version":"4.0","score":2.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-77285","title":"OpenBao Agent Writes Secrets to Stdout","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.","status":"published","published":"2026-09-23T17:59:13.118Z","modified":"2026-10-28T02:30:58.793668698Z","cvss":[{"version":"4.0","score":2.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"GHSA-444v-8vxr-p36h","title":"OpenBao Agent Writes Secrets to Stdout","description":"### Impact\n\nDuring certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in `env_template` to stdout. This primarily happens when `num_retries` is met.\n\nThis vulnerability is original to Vault and was reported via the OpenBao security mailing list.\n\n### Patches\n\nThis is addressed in OpenBao v2.6.0 GA.","status":"published","published":"2026-09-22T20:36:46Z","modified":"2026-10-01T20:56:23.916979102Z","cvss":[{"version":"4.0","score":2.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"BIT-openbao-2026-77285","title":"OpenBao Agent Writes Secrets to Stdout","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.","status":"published","published":"2026-10-01T09:31:12.641Z","modified":"2026-10-01T20:56:23.916979102Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"GO-2026-6554","title":"OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao","description":"OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao","status":"published","published":"2026-10-01T20:23:38Z","modified":"2026-10-01T20:56:23.916979102Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}