CVE-2026-115356

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

State: Published
Severity: 5.3 Medium
Published: Oct 22, 2026
Updated: Oct 23, 2026
Reserved: Oct 22, 2026

Description

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
openbaoopenbao	before 2.6.4Affected 2.6.4Not affected 2.7.0 to before 2.7.1Affected 2.7.1Not affected

References

GitHub Security Advisory (GHSA-gf3j-hm38-jhh5)vendor-advisory
VulnCheck Advisory: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.