{"id":"CVE-2026-115369","kind":"vulnerability","aliases":["CVE-2026-115369"],"related":[],"title":"OpenBao: PKI role CIDR limit skipped for IP SANs taken from CSRs","description":"OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.","summary":"OpenBao 2.5.0 before 2.6.2 does not enforce the allowed_ip_sans_cidr restriction on IP SANs read from a CSR when use_csr_sans is enabled. An authenticated caller with sign permission can get CA-signed certificates for IP addresses outside the role's allowed range.","severity":"low","cvss":2.2,"epss":0.00134,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["certificates","openbao","package","pki"],"not_affected_if":["default-config","no-csr-sans"],"how_to_check":"- Check the OpenBao version with `bao version`; affected builds are 2.5.0 up to but not including 2.6.2.\n- Look for PKI roles with `use_csr_sans` enabled and `allowed_ip_sans_cidr` set, using `bao read pki/roles/<role>`.","fix":"- Upgrade OpenBao to `2.6.2` or later.","status":"open","published_at":"2026-10-22T19:17:43+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:49:54+00:00","updated_at":"2026-10-25T04:49:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:49:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenBao to `2.6.2` or later.","reach":"network","title":"OpenBao: PKI role CIDR limit skipped for IP SANs taken from CSRs","impact":"medium","summary":"OpenBao 2.5.0 before 2.6.2 does not enforce the allowed_ip_sans_cidr restriction on IP SANs read from a CSR when use_csr_sans is enabled. An authenticated caller with sign permission can get CA-signed certificates for IP addresses outside the role's allowed range.","category":"package","nicknames":[],"who_cares":["openbao","pki","certificates"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker obtains CA-signed certificates for unauthorized IP addresses.","analyst_note":"","how_to_check":"- Check the OpenBao version with `bao version`; affected builds are 2.5.0 up to but not including 2.6.2.\n- Look for PKI roles with `use_csr_sans` enabled and `allowed_ip_sans_cidr` set, using `bao read pki/roles/<role>`.","needs_analyst":false,"not_affected_if":["default-config","no-csr-sans"],"who_is_affected":"Teams running OpenBao as a certificate authority in versions 2.5.0 to 2.6.2 that use PKI roles with use_csr_sans enabled and an allowed_ip_sans_cidr restriction. Deployments without CSR SAN passthrough or without a CIDR restriction on IP SANs are not exposed to this specific bypass.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000631,"input_tokens":3414,"output_tokens":579,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115369':15A,18A '-2026':14A,17A '2.5.0':24B,72C '2.6.2':26B,74C 'address':63B 'allow':31B,68B,81C 'authent':50B,99C 'ca':58B,121C 'ca-sign':57B,120C 'caller':51B,100C 'certif':19B,60B,123C 'cidr':4A,34B,84C 'csr':42B,45B,92C,95C,107C 'csrs':12A 'cve':13A,16A 'enabl':48B,98C 'enforc':29B,77C 'fail':75C 'get':56B 'ip':8A,32B,37B,62B,82C,87C,114C,126C 'limit':5A 'obtain':119C 'openbao':1A,20B,23B,70C 'out-of-rang':110C 'outsid':64B 'packag':21B 'permiss':54B,103C 'pki':2A,22B,79C 'pki/sign':117C 'rang':69B,113C 'read':39B 'restrict':35B,85C 'role':3A,66B,80C 'san':9A,33B,38B,46B,83C,88C,96C,115C 'sign':53B,59B,102C,122C 'skip':6A 'submit':105C 'taken':10A,89C 'unauthor':125C 'use':44B,94C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenBao as a certificate authority in versions 2.5.0 to 2.6.2 that use PKI roles with use_csr_sans enabled and an allowed_ip_sans_cidr restriction. Deployments without CSR SAN passthrough or without a CIDR restriction on IP SANs are not exposed to this specific bypass.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115369","severity":null,"published_at":"2026-10-22T19:17:43+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115369","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115369","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}