CVE-2026-115363

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

State: Published
Severity: 2.1 Low
Published: Oct 22, 2026
Updated: Oct 29, 2026
Reserved: Oct 22, 2026

Description

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	3.3 Low	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

Affected Products

Product	Versions
openbaoopenbao	2.2.0 to before 2.6.4Affected 2.6.4Not affected 2.7.0 to before 2.7.1Affected 2.7.1Not affected

References

GitHub Security Advisory (GHSA-3237-j65r-m5rp)vendor-advisory
VulnCheck Advisory: OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configurationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.