{"id":"CVE-2026-115362","kind":"vulnerability","aliases":["CVE-2026-115362"],"related":[],"title":"OpenBao: expired AppRole Secret IDs still log in until tidy runs","description":"OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.","summary":"OpenBao does not check Secret ID expiration when a client logs in through the AppRole auth method, so an expired Secret ID keeps working until the periodic tidy job deletes it. An attacker holding such an expired, not-yet-tidied Secret ID can obtain a token and access beyond its intended lifetime.","severity":"low","cvss":2.2,"epss":0.00197,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["approle","openbao","package","secrets-management","self-hosted"],"not_affected_if":["no-approle","non-expiring-secret-ids"],"how_to_check":"- Run `bao version` and compare against the fixed releases.\n- Check whether AppRole is enabled with `bao auth list` and whether Secret IDs use short TTLs with `bao read auth/approle/role/<role>`.\n- Check the tidy schedule with `bao read auth/approle/config` or the tidy settings in the server configuration.","fix":"- Upgrade OpenBao to `2.6.4` or later on the 2.6 line, or `2.7.1` or later on the 2.7 line.\n- Until upgraded, revoke Secret IDs that should no longer be valid with `bao write -f auth/approle/role/<role>/secret-id/destroy` and rotate them on a shorter schedule.","status":"open","published_at":"2026-10-22T19:17:42+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:49:54+00:00","updated_at":"2026-10-25T04:49:54+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-25T04:49:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenBao to `2.6.4` or later on the 2.6 line, or `2.7.1` or later on the 2.7 line.\n- Until upgraded, revoke Secret IDs that should no longer be valid with `bao write -f auth/approle/role/<role>/secret-id/destroy` and rotate them on a shorter schedule.","reach":"network","title":"OpenBao: expired AppRole Secret IDs still log in until tidy runs","impact":"medium","summary":"OpenBao does not check Secret ID expiration when a client logs in through the AppRole auth method, so an expired Secret ID keeps working until the periodic tidy job deletes it. An attacker holding such an expired, not-yet-tidied Secret ID can obtain a token and access beyond its intended lifetime.","category":"package","nicknames":[],"who_cares":["openbao","approle","self-hosted","secrets-management"],"confidence":0.75,"needs_auth":"yes","worst_case":"expired Secret ID logs in and gets a token past its TTL","analyst_note":"","how_to_check":"- Run `bao version` and compare against the fixed releases.\n- Check whether AppRole is enabled with `bao auth list` and whether Secret IDs use short TTLs with `bao read auth/approle/role/<role>`.\n- Check the tidy schedule with `bao read auth/approle/config` or the tidy settings in the server configuration.","needs_analyst":false,"not_affected_if":["no-approle","non-expiring-secret-ids"],"who_is_affected":"Teams that run OpenBao with the AppRole auth method and issue Secret IDs with expiration times, particularly those that hand Secret IDs to automated systems. Deployments that do not use AppRole, or that issue no expiring Secret IDs, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00067,"input_tokens":3380,"output_tokens":664,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115362':14A,17A '-2026':13A,16A '2.6.4':82C '2.7':84C '2.7.1':87C 'access':75B,125C 'approl':3A,18B,41B,98C 'attack':59B,113C 'auth':42B,99C 'beyond':76B,126C 'check':30B,90C 'client':36B 'cve':12A,15A 'delet':56B 'expir':2A,33B,46B,63B,93C,102C,116C 'gain':124C 'hold':60B,114C 'host':26B 'id':5A,32B,48B,69B,92C,104C,119C 'intend':78B 'job':55B 'keep':49B 'leav':101C 'lifetim':79B 'log':7A,37B,121C 'manag':23B 'method':43B,100C 'not-yet-tidi':64B 'obtain':71B 'openbao':1A,19B,27B,80C 'packag':20B 'period':53B,108C 'remov':110C 'run':11A 'secret':4A,22B,31B,47B,68B,91C,103C,118C 'secrets-manag':21B 'self':25B 'self-host':24B 'still':6A 'tidi':10A,54B,67B,109C 'token':73B 'ttl':128C 'untidi':117C 'use':95C 'valid':105C 'work':50B 'x':85C 'yet':66B","nicknames":[],"mitigations":[],"who_affected":"Teams that run OpenBao with the AppRole auth method and issue Secret IDs with expiration times, particularly those that hand Secret IDs to automated systems. Deployments that do not use AppRole, or that issue no expiring Secret IDs, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115362","severity":null,"published_at":"2026-10-22T19:17:42+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115362","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115362","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}