Skip to content
CVE PROGRAM SOURCE RECORD2.1 Low

CVE-2026-115357

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openbao openbao

Default version status: unaffected

  • 0 to < 2.6.4affected
  • 2.6.4unaffected
  • 2.7.0 to < 2.7.1affected
  • 2.7.1unaffected
pkg:golang/github.com/openbao/openbao/v2

References