Live › vulnerability › CVE-2026-115357
Go to dashboardOpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit records for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when response audit logging fails. An attacker can complete root token generation or rekey operations without a matching response audit record, which weakens forensic detection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted OpenBao with audit devices enabled, where sys/generate-root, sys/rekey, or sys/rekey-recovery-key are reachable. The impact is limited to forensic visibility of those operations when response audit logging fails. Teams on patched versions or without audit logging can skip it.
No product ranges from the sources yet.
bao version; versions below 2.6.4 or in the 2.7.x line below 2.7.1 are affected.bao audit list.2.6.4 or later on the 2.6 line, or 2.7.1 or later on the 2.7 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.
This page as .md · .json · in your agent: get_signal("CVE-2026-115357")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.