LOW 2.0 NVD
CVE-2026-115358
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin p
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.
References
- https://github.com/openbao/openbao/security/advisories/GHSA-8xxq-mq9m-xmhw
- https://www.vulncheck.com/advisories/openbao-before-2.6.3-sensitive-data-leak-in-audit-log
This low severity vulnerability with a CVSS score of 2.0 was published on 2026-10-22 via NVD.
vulnfeed aggregates 17279 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.