---
id: "CVE-2026-115356"
kind: "vulnerability"
aliases: ["CVE-2026-115356"]
title: "OpenBao: Kubernetes-auth tokens stay renewable after their service account is deleted"
severity: "medium"
cvss: 5.4
epss: 0.00174
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["kubernetes", "openbao", "package", "self-hosted"]
not_affected_if: ["kubernetes-auth-disabled", "managed-hosting"]
published_at: "2026-10-22T19:17:41+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:14:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115356", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115356", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# OpenBao: Kubernetes-auth tokens stay renewable after their service account is deleted

OpenBao does not re-check the originating Kubernetes service account token when renewing a token issued by the Kubernetes auth method. An attacker who already holds such a token can keep renewing it and retain access after the service account has been deleted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenBao version with `bao version`
- Review whether the Kubernetes auth method is enabled with `bao auth list`

## Fix

- Upgrade OpenBao to `2.6.4` or later on the 2.6 line, or to `2.7.1` or later on the 2.7 line
- Revoke tokens issued through the Kubernetes auth method for deleted service accounts

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115356
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115356

## From the sources

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_