CVE-2026-115358

OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

State: Published
Severity: 2.0 Low
Published: Oct 22, 2026
Updated: Oct 29, 2026
Reserved: Oct 22, 2026

Description

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.

Scores

CVSS	Score	Vector	Source
4.0	2.0 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	2.0 Low	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-532 Insertion of Sensitive Information into Log File

Affected Products

Product	Versions
openbaoopenbao	before 2.6.3Affected 2.6.3Not affected
openbaoopenbao	before 2.6.3Affected 2.6.3Not affected 2.7.0 to before 2.7.1Affected 2.7.1Not affected

References

GitHub Security Advisory (GHSA-8xxq-mq9m-xmhw)vendor-advisory
VulnCheck Advisory: OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parametersthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.