Live › vulnerability › CVE-2026-115359
Go to dashboardOpenBao's rate limit quota subsystem fails to resolve the role for requests with form-encoded bodies or forwarded certificates, so role-scoped quota rules are not applied. A valid caller can repeatedly request tokens without using up the configured role-based rate limit budget.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OpenBao before 2.6.4 or 2.7.x before 2.7.1 that rely on role-scoped rate limit quotas to throttle token issuance. Deployments without role-scoped quotas are not exposed through this flaw, and the impact is limited to bypassing a throttle rather than gaining access.
No product ranges from the sources yet.
bao version2.6.4 or later2.7.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
This page as .md · .json · in your agent: get_signal("CVE-2026-115359")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.