---
id: "CVE-2026-115362"
kind: "vulnerability"
aliases: ["CVE-2026-115362"]
title: "OpenBao: expired AppRole Secret IDs still log in until tidy runs"
severity: "low"
cvss: 2.2
epss: 0.00197
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["approle", "openbao", "package", "secrets-management", "self-hosted"]
not_affected_if: ["no-approle", "non-expiring-secret-ids"]
published_at: "2026-10-22T19:17:42+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:49:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115362", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115362", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# OpenBao: expired AppRole Secret IDs still log in until tidy runs

OpenBao does not check Secret ID expiration when a client logs in through the AppRole auth method, so an expired Secret ID keeps working until the periodic tidy job deletes it. An attacker holding such an expired, not-yet-tidied Secret ID can obtain a token and access beyond its intended lifetime.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `bao version` and compare against the fixed releases.
- Check whether AppRole is enabled with `bao auth list` and whether Secret IDs use short TTLs with `bao read auth/approle/role/<role>`.
- Check the tidy schedule with `bao read auth/approle/config` or the tidy settings in the server configuration.

## Fix

- Upgrade OpenBao to `2.6.4` or later on the 2.6 line, or `2.7.1` or later on the 2.7 line.
- Until upgraded, revoke Secret IDs that should no longer be valid with `bao write -f auth/approle/role/<role>/secret-id/destroy` and rotate them on a shorter schedule.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115362
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115362

## From the sources

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_