CVE-2026-115363

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115363", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-22T11:21:20.779Z", "datePublished": "2026-10-22T19:13:37.600Z", "dateUpdated": "2026-10-29T11:56:00.897Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:37.600Z"}, "datePublic": "2026-10-01T00:00:00.000Z", "title": "OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration", "descriptions": [{"lang": "en", "value": "OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Removal of Sensitive Information Before Storage or Transfer", "cweId": "CWE-212", "type": "CWE"}]}], "affected": [{"vendor": "openbao", "product": "openbao", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao/v2", "versions": [{"version": "2.2.0", "status": "affected", "versionType": "semver", "lessThan": "2.6.4"}, {"version": "2.6.4", "status": "unaffected", "versionType": "semver"}, {"version": "2.7.0", "status": "affected", "versionType": "semver", "lessThan": "2.7.1"}, {"version": "2.7.1", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.2.0", "versionEndExcluding": "2.6.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.7.0", "versionEndExcluding": "2.7.1"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-3237-j65r-m5rp)"}, {"name": "VulnCheck Advisory: OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/openbao-2.2.0-before-2.6.4-and-2.7.0-before-2.7.1-acme-eab-mac-key-disclosure-via-sanitized-configuration"}], "credits": [{"lang": "en", "value": "Luiggi33", "type": "finder"}, {"lang": "en", "value": "opensec-intelligence", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T11:55:06.717680Z", "id": "CVE-2026-115363", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T11:56:00.897Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115363", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T11:55:06.717680Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T11:55:49.062Z"}}], "cna": {"title": "OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration", "credits": [{"lang": "en", "type": "finder", "value": "Luiggi33"}, {"lang": "en", "type": "reporter", "value": "opensec-intelligence"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "openbao", "product": "openbao", "versions": [{"status": "affected", "version": "2.2.0", "lessThan": "2.6.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.6.4", "versionType": "semver"}, {"status": "affected", "version": "2.7.0", "lessThan": "2.7.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.7.1", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/openbao/openbao/v2", "defaultStatus": "unaffected"}], "datePublic": "2026-10-01T00:00:00.000Z", "references": [{"url": "https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp", "name": "GitHub Security Advisory (GHSA-3237-j65r-m5rp)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/openbao-2.2.0-before-2.6.4-and-2.7.0-before-2.7.1-acme-eab-mac-key-disclosure-via-sanitized-configuration", "name": "VulnCheck Advisory: OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-212", "description": "Improper Removal of Sensitive Information Before Storage or Transfer"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.6.4", "versionStartIncluding": "2.2.0"}, {"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.7.1", "versionStartIncluding": "2.7.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:37.600Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115363", "state": "PUBLISHED", "dateUpdated": "2026-10-29T11:56:00.897Z", "dateReserved": "2026-10-22T11:21:20.779Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-22T19:13:37.600Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao/v2", "product": "openbao", "vendor": "openbao", "versions": [{"lessThan": "2.6.4", "status": "affected", "version": "2.2.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.6.4", "versionType": "semver"}, {"lessThan": "2.7.1", "status": "affected", "version": "2.7.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.7.1", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account."}], "id": "CVE-2026-115363", "lastModified": "2026-10-29T12:17:11.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 2.5, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115363", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T11:55:06.717680Z", "version": "2.0.3"}}]}, "published": "2026-10-22T19:17:42.660", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/openbao-2.2.0-before-2.6.4-and-2.7.0-before-2.7.1-acme-eab-mac-key-disclosure-via-sanitized-configuration"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-212"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/openbao/openbao: OpenBao: Information disclosure via sanitized configuration endpoint", "id": "2559262", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559262"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-212", "details": ["OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.", "A flaw was found in OpenBao. When External Account Binding (EAB) is configured with the Automatic Certificate Management Environment (ACME) to manage certificates, the sanitized configuration endpoint fails to redact the EAB Message Authentication Code (MAC) key. An authenticated user with permission to query the sanitized configuration endpoint can retrieve this sensitive key, resulting in information disclosure and allowing unauthorized binding to the operator's ACME account."], "name": "CVE-2026-115363", "public_date": "2026-10-22T19:13:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115363\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115363\nhttps://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp\nhttps://www.vulncheck.com/advisories/openbao-2.2.0-before-2.6.4-and-2.7.0-before-2.7.1-acme-eab-mac-key-disclosure-via-sanitized-configuration"], "statement": "This vulnerability is rated as Low severity because successful exploitation requires an attacker to already possess high-privilege access to inspect sanitized server state, and the leak only occurs when using an optional ACME configuration with External Account Binding. Furthermore, OpenBao is not distributed or supported within Red Hat products, meaning supported enterprise environments are not directly affected.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,2.6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.6.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.7.0,2.7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.7.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "openbao", "source": "cna", "vendor": "openbao"}, "product": "openbao", "vendor": "openbao"}], "created": "2026-10-23T04:00:12.776678+00:00", "updated": "2026-10-23T05:15:13.854274+00:00", "vendors": ["openbao", "openbao$PRODUCT$openbao"]}