LOW GitHub
CVE-2026-77285
OpenBao Agent Writes Secrets to Stdout
### Impact
During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in `env_template` to stdout. This primarily happens when `num_retries` is met.
This vulnerability is original to Vault and was reported via the OpenBao security mailing list.
### Patches
This is addressed in OpenBao v2.6.0 GA.
Affected Products
- go/github.com/openbao/openbao < 0.0.0-20260714163218-90272575e5f5
- go/github.com/openbao/openbao >= 0.1.0, <= 1.1.5
References
- https://github.com/advisories/GHSA-444v-8vxr-p36h
- https://github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h
- https://github.com/openbao/openbao/pull/3494
- https://github.com/openbao/openbao/pull/3495
This low severity vulnerability was published on 2026-09-22 via GitHub. Affected: go/github.com/openbao/openbao < 0.0.0-20260714163218-90272575e5f5, go/github.com/openbao/openbao >= 0.1.0, <= 1.1.5.
vulnfeed aggregates 13417 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.