BIT-openbao-2026-115356

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2026-115356.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-openbao-2026-115356
Aliases
Published
2026-10-29T08:54:33Z
Modified
2026-10-29T10:55:42Z
Summary
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
Details

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:openbao:openbao:*:*:*:*:*:go:*:*"
    ],
    "severity":  "Medium"
}
References

Affected packages

Bitnami / openbao

Package

Name
openbao
Purl
pkg:bitnami/openbao

Severity

  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.4
Introduced
2.7.0
Fixed
2.7.1

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2026-115356.json"