openbao vulnerabilities (Bitnami)
47 vulnerabilities.
-
openbaoBitnami OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs 2.1 Low -
openbaoBitnami OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs 2.0 Low -
openbaoBitnami OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal 7.5 High -
openbaoBitnami OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints 2.1 Low -
openbaoBitnami OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration 2.1 Low -
openbaoBitnami OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass 2.1 Low -
openbaoBitnami OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial 2.1 Low -
openbaoBitnami OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI 5.3 Medium -
openbaoBitnami OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing 6.3 Medium -
openbaoBitnami OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters 2.0 Low -
openbaoBitnami OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses 2.1 Low -
openbaoBitnami OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation 5.3 Medium -
openbaoBitnami OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix) 6.0 Medium -
openbaoBitnami OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack 9.2 Critical -
openbaoBitnami OpenBao Agent Writes Secrets to Stdout 2.4 Low -
openbaoBitnami OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters 7.5 High -
openbaoBitnami OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types 6.5 Medium -
openbaoBitnami OpenBao's System Backend allows Unauthorized Management of the containing Namespace 2.3 Low -
openbaoBitnami OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 2.1 Low -
openbaoBitnami OpenBao: LDAPi ldaputil (wrong escape func) 6.8 Medium -
openbaoBitnami OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens 5.3 Medium -
openbaoBitnami OpenBao's Inline Auth Incorrectly Redacted Headers 5.4 Medium -
openbaoBitnami OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL 7.1 High -
openbaoBitnami OpenBao's Namespace Deletion May Not Delete Data Properly 2.3 Low -
openbaoBitnami OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation 2.0 Low -
openbaoBitnami OpenBao allows SQL Injection in PostgreSQL database secrets engine 4.6 Medium -
openbaoBitnami OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) 3.1 Low -
openbaoBitnami OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate 2.0 Low -
openbaoBitnami OpenBao has Reflected XSS in its OIDC authentication error message 9.4 Critical -
openbaoBitnami OpenBao lacks user confirmation for OIDC direct callback mode 9.6 Critical -
openbaoBitnami OpenBao Privileged Operator Identity Group Root Escalation 7.5 High -
openbaoBitnami OpenBao and Vault Leak []byte Fields in Audit Logs 5.7 Medium -
openbaoBitnami OpenBao leaks HTTPRawBody in Audit Logs 5.7 Medium -
openbaoBitnami OpenBao vulnerable to denial of service via malicious JSON request processing 7.5 High -
openbaoBitnami OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias 6.5 Medium -
openbaoBitnami OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse 5.7 Medium -
openbaoBitnami OpenBao TOTP Secrets Engine Enables Code Reuse 6.5 Medium -
openbaoBitnami OpenBao: Timing Side-Channel in Userpass Auth Method 3.7 Low -
openbaoBitnami OpenBao Userpass and LDAP User Lockout Bypass 5.3 Medium -
openbaoBitnami OpenBao: Privileged Operator May Execute Code on the Underlying Host 9.1 Critical -
openbaoBitnami OpenBao Root Namespace Operator May Elevate Token Privileges 7.2 High -
openbaoBitnami OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation 6.9 Medium -
openbaoBitnami OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data 4.5 Medium -
openbaoBitnami Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin 4.5 Medium -
openbaoBitnami Vault Vulnerable to Denial of Service When Processing Raft Join Requests 7.5 High -
openbaoBitnami Vault Operators in Root Namespace May Elevate Their Privileges 7.2 High -
openbaoBitnami Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default 7.5 High