openbao vulnerabilities (openSUSE)
32 vulnerabilities.
-
openbaoopenSUSE OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens 5.3 Medium -
openbaoopenSUSE OpenBao's Inline Auth Incorrectly Redacted Headers 5.4 Medium -
openbaoopenSUSE OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL 7.1 High -
openbaoopenSUSE OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation 2.0 Low -
openbaoopenSUSE OpenBao allows SQL Injection in PostgreSQL database secrets engine 4.6 Medium -
openbaoopenSUSE OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) 3.1 Low -
openbaoopenSUSE OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate 2.0 Low -
openbaoopenSUSE Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations 7.5 High -
openbaoopenSUSE Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service 8.1 High -
openbaoopenSUSE OpenBao has Reflected XSS in its OIDC authentication error message 9.4 Critical -
openbaoopenSUSE OpenBao lacks user confirmation for OIDC direct callback mode 9.6 Critical -
openbaoopenSUSE OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking 7.0 High -
openbaoopenSUSE Unexpected session resumption in crypto/tls 10.0 Critical -
openbaoopenSUSE OpenBao Privileged Operator Identity Group Root Escalation 7.5 High -
openbaoopenSUSE OpenBao and Vault Leak []byte Fields in Audit Logs 5.7 Medium -
openbaoopenSUSE OpenBao leaks HTTPRawBody in Audit Logs 5.7 Medium -
openbaoopenSUSE Vault unauthenticated denial of service through complex json payload 7.5 High -
openbaoopenSUSE Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No score -
openbaoopenSUSE OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse 5.7 Medium -
openbaoopenSUSE OpenBao TOTP Secrets Engine Enables Code Reuse 6.5 Medium -
openbaoopenSUSE OpenBao Root Namespace Operator May Elevate Token Privileges 7.2 High -
openbaoopenSUSE Vault LDAP MFA Enforcement Bypass When Using Username As Alias 6.5 Medium -
openbaoopenSUSE Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse 5.7 Medium -
openbaoopenSUSE Timing Side-Channel in Vault’s Userpass Auth Method 3.7 Low -
openbaoopenSUSE Vault Userpass and LDAP User Lockout Bypass 5.3 Medium -
openbaoopenSUSE Vault TOTP Secrets Engine Code Reuse 6.5 Medium -
openbaoopenSUSE Arbitrary Remote Code Execution via Plugin Catalog Abuse 9.1 Critical -
openbaoopenSUSE Vault Root Namespace Operator May Elevate Token Privileges 7.2 High -
openbaoopenSUSE OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation 6.9 Medium -
openbaoopenSUSE OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data 4.5 Medium -
openbaoopenSUSE Vault Vulnerable to Recovery Key Cancellation Denial of Service 3.1 Low -
openbaoopenSUSE Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin 4.5 Medium