MEDIUM 5.3 NVD
CVE-2026-115356
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token original
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.
References
- https://github.com/openbao/openbao/security/advisories/GHSA-gf3j-hm38-jhh5
- https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-kubernete
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-22 via NVD.
vulnfeed aggregates 17279 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.