---
id: "CVE-2026-115358"
kind: "vulnerability"
aliases: ["CVE-2026-115358"]
title: "OpenBao: malformed plugin parameters leak sensitive input into audit logs"
severity: "low"
cvss: 2.0
epss: 0.00195
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["audit-logging", "infrastructure", "openbao", "self-hosted"]
not_affected_if: ["version-2.6.3-or-later"]
published_at: "2026-10-22T19:17:41+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:50:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115358", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115358", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# OpenBao: malformed plugin parameters leak sensitive input into audit logs

OpenBao before 2.6.3 records error messages containing sensitive input into its audit logs when a request sends malformed TypeKVPair or TypeHeader plugin parameter values. An attacker who can send such requests can read secrets that were passed in those values from the audit log.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `bao version` and compare against `2.6.3`
- Check whether audit devices are enabled with `bao audit list`
- unknown

## Fix

- Upgrade OpenBao to `2.6.3` or later
- Restrict who can read audit log files until upgraded

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115358
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115358

## From the sources

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_