← All reports

Prior to version 2.5.3, OpenBao had vulnerabilities that allowed tenant token accessors to be revoked or renewed by privileged administrators, posing a security risk.

CybersecurityTechnologyConflictApr 21, 2026score 0.172 posts · 0 replies across 1 instances
The thread discusses two vulnerabilities in the openbao software, both related to security issues in its handling of container images and token management. These vulnerabilities highlight potential risks in the software's security features, which could impact the reliability and safety of systems using openbao.

Claims

Prior to version 2.5.3, OpenBao had vulnerabilities that allowed tenant token accessors to be revoked or renewed by privileged administrators, posing a security risk.
Parent: Software SecurityEntity: OpenBaoImpact: negativeDate: Apr 21, 2026Target: The security of OpenBao prior to version 2.5.3
Prior to version 2.5.3, OpenBao's OCI plugin downloader had a vulnerability that allowed insecure extraction of plugin binaries from container images, creating a potential security risk.
Parent: Software SecurityEntity: OpenBaoImpact: negativeDate: Apr 21, 2026Target: The security of OpenBao prior to version 2.5.3

Source posts

@[email protected]
🚨 EUVD-2026-24035 📊 Score: 4.6/10 (CVSS v3.1) 📦 Product: openbao 🏢 Vendor: openbao 📅 Updated: 2026-04-21 📝 OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by Postgre... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24035 #cybersecurity #infosec #euvd #cve #vulnerability
1 boosts · 0 favs · 0 replies · Apr 21, 2026
#cybersecurity#infosec#euvd#cve#vulnerability
@[email protected]
🚨 EUVD-2026-24029 📊 Score: 2.0/10 (CVSS v3.1) 📦 Product: openbao 🏢 Vendor: openbao 📅 Updated: 2026-04-21 📝 OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented m... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24029 #cybersecurity #infosec #euvd #cve #vulnerability
1 boosts · 0 favs · 0 replies · Apr 21, 2026
#cybersecurity#infosec#euvd#cve#vulnerability
@[email protected]
🚨 EUVD-2026-24031 📊 Score: 3.1/10 (CVSS v3.1) 📦 Product: openbao 🏢 Vendor: openbao 📅 Updated: 2026-04-21 📝 OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24031 #cybersecurity #infosec #euvd #cve #vulnerability
0 boosts · 0 favs · 0 replies · Apr 21, 2026
#cybersecurity#infosec#euvd#cve#vulnerability
@[email protected]
🚨 EUVD-2026-24037 📊 Score: 2.0/10 (CVSS v3.1) 📦 Product: openbao 🏢 Vendor: openbao 📅 Updated: 2026-04-21 📝 OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in anot... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24037 #cybersecurity #infosec #euvd #cve #vulnerability
0 boosts · 0 favs · 0 replies · Apr 21, 2026
#cybersecurity#infosec#euvd#cve#vulnerability