Live › vulnerability › CVE-2026-115369
Go to dashboardOpenBao 2.5.0 before 2.6.2 does not enforce the allowed_ip_sans_cidr restriction on IP SANs read from a CSR when use_csr_sans is enabled. An authenticated caller with sign permission can get CA-signed certificates for IP addresses outside the role's allowed range.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OpenBao as a certificate authority in versions 2.5.0 to 2.6.2 that use PKI roles with use_csr_sans enabled and an allowed_ip_sans_cidr restriction. Deployments without CSR SAN passthrough or without a CIDR restriction on IP SANs are not exposed to this specific bypass.
No product ranges from the sources yet.
bao version; affected builds are 2.5.0 up to but not including 2.6.2.use_csr_sans enabled and allowed_ip_sans_cidr set, using bao read pki/roles/<role>.2.6.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.
This page as .md · .json · in your agent: get_signal("CVE-2026-115369")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.