---
id: "CVE-2026-77285"
kind: "vulnerability"
aliases: ["CVE-2026-77285", "GHSA-444v-8vxr-p36h", "GO-2026-6554"]
title: "OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao"
severity: "low"
cvss: 2.4
epss: 0.00125
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/openbao/openbao", "fixed": ["0.0.0-20260714163218-90272575e5f5"], "affected": ">= 0.1.0, < 0.0.0-20260714163218-90272575e5f5", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "openbao", "package", "secrets-management", "self-hosted"]
not_affected_if: ["no-env-template", "no-exec-mode", "version-2.6.0-or-later"]
published_at: "2026-09-23T19:19:15+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:49:22+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6554", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77285", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77285", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao

OpenBao Agent's exec mode can print rendered secrets from env_template to stdout after repeated template rendering failures. Anyone who can read that output, such as a log collector or a local user, can recover the secret values.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/openbao/openbao affected >= 0.1.0, < 0.0.0-20260714163218-90272575e5f5 fixed 0.0.0-20260714163218-90272575e5f5

## How to check

Check whether any OpenBao Agent config uses exec mode with env_template and num_retries set (look for num_retries under template or exec settings in the agent HCL file).
Check the Go module version: grep github.com/openbao/openbao go.mod or the openbao binary version.

## Fix

Upgrade github.com/openbao/openbao to 2.6.0 or the commit 0.0.0-20260714163218-90272575e5f5 or later, then rebuild and redeploy.
Rotate any secrets that may have been rendered to logs while the failure occurred.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6554
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77285
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77285

## From the sources

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_