OpenBao: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
NEOSEC enrichment — no mirror of the original source
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OpenBao ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Highbsi:WID-SEC-2026-16401 linked CVE
Open advisory with all CVEs
More on OpenBao
Other advisories
- Not ratedosv:CLEANSTART-2026-IX31999OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys
- Not ratedosv:CLEANSTART-2026-CL56370Security fix for GHSA-hfvc-g4fc-pqhx applied in: kube-state-metrics 2.18.0-r2, bank-vaults 1.32.1-r1, etcd 3.6.10-r0, grafana 13.0.0-r0, minio 0.20250907.161309-r3, openbao 2.5.4-r1, velero 1.16.2-r4, argo-cd-fips 3.3.7-r0, temporal-server-fips 1.31.1-r1, kube-state-metrics 2.17.0-r1, cortex 1.21.1-r2, cortex 1.21.1-r3, thanos 0.41.0-r0, fulcio 1.8.7-r2, metrics-server 0.8.1-r2, metrics-server 0.8.1-r3, prometheus 3.10.0-r1
- Not ratedosv:CLEANSTART-2026-SG72830Security fix for GHSA-mh2q-q3fh-2475 applied in: bank-vaults 1.32.1-r1, minio 0.20250907.161309-r3, rclone 1.72.1-5, rclone 1.73.5-r0, haproxy-ingress 0.15.4-r0, openbao 2.5.4-r1, argo-cd-fips 3.3.7-r0, cortex 1.21.1-r2, cortex 1.21.1-r3, external-secrets-operator-fips 2.4.1-r0, thanos 0.41.0-r0, fulcio 1.8.7-r2, prometheus 3.10.0-r1
- Not ratedosv:CLEANSTART-2026-TI30680Security fix for GHSA-p77j-4mvh-x3m3 applied in: bank-vaults 1.32.1-r1, gitea 1.25.5-r0, minio 0.20250907.161309-r0, rclone 1.73.2-r0, openbao 2.5.4-r1, velero 1.16.2-r4, cortex 1.21.1-r2, cortex 1.21.1-r3, traefik 3.6.11-r4, smarter-device-manager 1.20.11-r1, smarter-device-manager 1.20.11-r2, velero-plugin-for-aws 1.11.1-r2, calico 3.31.4-r0, kube-state-metrics 2.16.0-r5, fulcio 1.8.7-r2, metrics-server 0.8.1-r2, metrics-server 0.8.1-r3, prometheus 3.9.1-r1
- Not ratedosv:CLEANSTART-2026-XC19453Security fix for GHSA-78h2-9frx-2jm8 applied in: bank-vaults 1.32.1-r1, opentofu-fips 1.10.9-r4, openbao 2.5.4-r1, velero 1.16.2-r5, temporal-server-fips 1.31.1-r1, opentofu-fips 1.11.5-r3, consul 1.20.6-r0, thanos 0.41.0-r0, fulcio 1.8.7-r2
- Not ratedosv:CLEANSTART-2026-VG29890Security fix for GHSA-gcjh-h69q-9w9g applied in: cert-manager 1.18.6-r4, kube-state-metrics 2.20.0-r0, kyverno 1.18.2-r1, rabbitmq-cluster-operator 2.20.1-r5, rabbitmq-cluster-operator 2.21.1-r2, kedacore-http-add-on 0.15.0-r0, kubernetes-csi-external-resizer 2.0.0-r2, kedacore-http-add-on 0.13.0-r0, kyverno 1.17.2-r2, yunikorn-k8shim 1.8.0-r1, rabbitmq-messaging-topology-operator 1.19.3-r2, tekton-chains 0.29.7-r1, kube-state-metrics 2.18.0-r7, kube-state-metrics 2.19.1-r1, external-secrets-operator-fips 2.7.0-r1, eks-distro-kube-scheduler 1.36.9-r1, kube-rbac-proxy-fips 0.22.0-r1, cluster-autoscaler 1.35.2-r1, cluster-autoscaler 1.36.1-r1, cluster-autoscaler 1.36.1-r6, cluster-autoscaler 1.36.1-r7, kubernetes 1.33.13-r0, openbao 2.6.3-r1, helm-operator 1.39.2-r1, helm-operator 1.42.3-r2, helm-operator 1.40.0-r1, calico 3.30.7-r6, fluent-operator 3.10.0-r0, metallb 0.16.0-r2, calico 3.32.1-r1, kube-state-metrics 2.16.0-r9, grafana-org-operator 1.13.0-r0
- Not ratedosv:CLEANSTART-2026-QD11639Security fix for GHSA-8wmf-6v46-5gfg applied in: cluster-autoscaler-fips 1.33.6-r2, weaviate-fips 1.38.19-r1, eks-distro-kube-apiserver 1.36.8-r1, kyverno 1.19.1-r1, openbao 2.6.3-r1, thanos 0.39.2-r7
- Not ratedosv:CLEANSTART-2026-KQ73125Security fix for GHSA-j88v-2chj-qfwx applied in: grafana 13.0.1-r0, openbao 2.5.4-r1, temporal-server-fips 1.31.1-r1, kumactl 2.14.0-r1
Other news entries
- OpenBao: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenVulnerabilityBSI CERT-Bund
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1640
ID