CVE-2026-115356
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.
| CWE | CWE-613 |
| Vendor | openbao |
| Product | openbao |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for openbao openbao
Be the first to know when new medium vulnerabilities affecting openbao openbao are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
openbao / openbao
0 < 2.6.4 2.7.0 < 2.7.1
References
Credits
06kellyjac