{"id":"CVE-2026-115363","kind":"vulnerability","aliases":["CVE-2026-115363"],"related":[],"title":"OpenBao: sanitized config endpoint leaks ACME external account binding key","description":"OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.","summary":"OpenBao's sys/config/state/sanitized endpoint exposes the tls_acme_eab_mac_key value used for ACME external account binding. A caller of that endpoint can read the key and bind to the operator's ACME account.","severity":"low","cvss":3.3,"epss":0.00125,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acme","openbao","package","self-hosted","tls"],"not_affected_if":["acme-not-used","default-config","managed-hosting"],"how_to_check":"- Run `bao version` and compare against the fixed versions listed in fix.\n- Check whether the config sets `tls_acme_eab_mac_key` or uses ACME TLS listeners, since the key only matters in that setup.","fix":"- Upgrade OpenBao to `2.6.4` on the 2.6 line, or to `2.7.1` on the 2.7 line.\n- Rotate the ACME external account binding MAC key after upgrading if the endpoint was reachable by untrusted callers.","status":"open","published_at":"2026-10-22T19:17:42+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:45:51+00:00","updated_at":"2026-10-25T04:45:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:45:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenBao to `2.6.4` on the 2.6 line, or to `2.7.1` on the 2.7 line.\n- Rotate the ACME external account binding MAC key after upgrading if the endpoint was reachable by untrusted callers.","reach":"network","title":"OpenBao: sanitized config endpoint leaks ACME external account binding key","impact":"low","summary":"OpenBao's sys/config/state/sanitized endpoint exposes the tls_acme_eab_mac_key value used for ACME external account binding. A caller of that endpoint can read the key and bind to the operator's ACME account.","category":"package","nicknames":[],"who_cares":["openbao","self-hosted","tls","acme"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads ACME account binding key and binds to operator's account","analyst_note":"","how_to_check":"- Run `bao version` and compare against the fixed versions listed in fix.\n- Check whether the config sets `tls_acme_eab_mac_key` or uses ACME TLS listeners, since the key only matters in that setup.","needs_analyst":false,"not_affected_if":["acme-not-used","managed-hosting","default-config"],"who_is_affected":"Only deployments of OpenBao 2.2.0 up to 2.6.4 and 2.7.0 that use ACME for TLS listener certificates with an external account binding key are exposed. Callers need access to the sanitized configuration endpoint, so teams that restrict sys/ paths or do not use ACME can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000631,"input_tokens":3421,"output_tokens":578,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115363':13A,16A '-2026':12A,15A '2.2.0':60C '2.6.4':62C '2.7.0':64C '2.7.1':66C 'account':8A,40B,58B,96C,113C 'acm':6A,17B,31B,38B,57B,76C,94C,112C 'bind':9A,41B,52B,97C,107C 'caller':43B,85C 'certif':104C 'config':3A 'configur':89C 'contain':67C 'cve':11A,14A 'disclosur':70C 'eab':32B,77C 'endpoint':4A,27B,46B,84C,90C 'expos':28B,73C 'extern':7A,39B,95C 'host':22B 'inform':69C 'key':10A,34B,50B,79C,99C 'leak':5A 'let':105C 'listen':103C 'mac':33B,78C,98C 'openbao':1A,18B,24B,59C 'oper':55B,110C 'packag':19B 'read':48B 'retriev':92C 'sanit':2A,88C 'self':21B 'self-host':20B 'sys/config/state/sanitized':26B,83C 'tls':23B,30B,75C,102C 'use':36B,100C 'valu':35B,80C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of OpenBao 2.2.0 up to 2.6.4 and 2.7.0 that use ACME for TLS listener certificates with an external account binding key are exposed. Callers need access to the sanitized configuration endpoint, so teams that restrict sys/ paths or do not use ACME can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115363","severity":null,"published_at":"2026-10-22T19:17:42+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115363","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115363","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}