---
id: "CVE-2026-115363"
kind: "vulnerability"
aliases: ["CVE-2026-115363"]
title: "OpenBao: sanitized config endpoint leaks ACME external account binding key"
severity: "low"
cvss: 3.3
epss: 0.00125
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["acme", "openbao", "package", "self-hosted", "tls"]
not_affected_if: ["acme-not-used", "default-config", "managed-hosting"]
published_at: "2026-10-22T19:17:42+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:45:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115363", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115363", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# OpenBao: sanitized config endpoint leaks ACME external account binding key

OpenBao's sys/config/state/sanitized endpoint exposes the tls_acme_eab_mac_key value used for ACME external account binding. A caller of that endpoint can read the key and bind to the operator's ACME account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `bao version` and compare against the fixed versions listed in fix.
- Check whether the config sets `tls_acme_eab_mac_key` or uses ACME TLS listeners, since the key only matters in that setup.

## Fix

- Upgrade OpenBao to `2.6.4` on the 2.6 line, or to `2.7.1` on the 2.7 line.
- Rotate the ACME external account binding MAC key after upgrading if the endpoint was reachable by untrusted callers.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115363
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115363

## From the sources

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_