CVE-2026-115357
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses
CVSS Score
2.2
EPSS Score
0.0%
EPSS Percentile
0th
OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.
| CWE | CWE-778 |
| Vendor | openbao |
| Product | openbao |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for openbao openbao
Be the first to know when new low vulnerabilities affecting openbao openbao are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
openbao / openbao
0 < 2.6.4 2.7.0 < 2.7.1
References
Credits
phil9909