MEDIUM 6.3 NVD
CVE-2026-115359
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
References
- https://github.com/openbao/openbao/security/advisories/GHSA-5v22-543h-wg96
- https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-role-base
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-22 via NVD.
vulnfeed aggregates 17279 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.