CVE-2026-115362

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

State: Published
Severity: 2.1 Low
Published: Oct 22, 2026
Updated: Oct 29, 2026
Reserved: Oct 22, 2026

Description

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	2.2 Low	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
openbaoopenbao	before 2.6.4Affected 2.6.4Not affected 2.7.0 to before 2.7.1Affected 2.7.1Not affected

References

GitHub Security Advisory (GHSA-7m59-mp95-w6ph)vendor-advisory
VulnCheck Advisory: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypassthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.