Live › vulnerability › CVE-2026-115358
Go to dashboardOpenBao before 2.6.3 records error messages containing sensitive input into its audit logs when a request sends malformed TypeKVPair or TypeHeader plugin parameter values. An attacker who can send such requests can read secrets that were passed in those values from the audit log.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OpenBao with audit devices enabled, where the audit log is readable by people or systems beyond the operators who need it. The sources do not say whether default configurations are affected or which request paths are reachable without authentication.
No product ranges from the sources yet.
bao version and compare against 2.6.3bao audit list2.6.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.
This page as .md · .json · in your agent: get_signal("CVE-2026-115358")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.