CVE-2026-115369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115369", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-22T11:24:28.626Z", "datePublished": "2026-10-22T19:13:40.448Z", "dateUpdated": "2026-10-29T11:56:36.361Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:40.448Z"}, "datePublic": "2026-08-18T00:00:00.000Z", "title": "OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs", "descriptions": [{"lang": "en", "value": "OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "affected": [{"vendor": "openbao", "product": "openbao", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao", "versions": [{"version": "2.5.0", "status": "affected", "versionType": "semver", "lessThan": "2.6.2"}, {"version": "2.6.2", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.5.0", "versionEndExcluding": "2.6.2"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/openbao/openbao/security/advisories/GHSA-g892-p242-8g86", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-g892-p242-8g86)"}, {"name": "VulnCheck Advisory: OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/openbao-2.5.0-before-2.6.2-pki-allowed-ip-sans-cidr-bypass-via-csr-ip-sans"}], "credits": [{"lang": "en", "value": "AkshayJainG", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T11:56:23.469465Z", "id": "CVE-2026-115369", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T11:56:36.361Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115369", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T11:56:23.469465Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T11:56:30.098Z"}}], "cna": {"title": "OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs", "credits": [{"lang": "en", "type": "reporter", "value": "AkshayJainG"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "openbao", "product": "openbao", "versions": [{"status": "affected", "version": "2.5.0", "lessThan": "2.6.2", "versionType": "semver"}, {"status": "unaffected", "version": "2.6.2", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/openbao/openbao", "defaultStatus": "unaffected"}], "datePublic": "2026-08-18T00:00:00.000Z", "references": [{"url": "https://github.com/openbao/openbao/security/advisories/GHSA-g892-p242-8g86", "name": "GitHub Security Advisory (GHSA-g892-p242-8g86)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/openbao-2.5.0-before-2.6.2-pki-allowed-ip-sans-cidr-bypass-via-csr-ip-sans", "name": "VulnCheck Advisory: OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.6.2", "versionStartIncluding": "2.5.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:40.448Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115369", "state": "PUBLISHED", "dateUpdated": "2026-10-29T11:56:36.361Z", "dateReserved": "2026-10-22T11:24:28.626Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-22T19:13:40.448Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao", "product": "openbao", "vendor": "openbao", "versions": [{"lessThan": "2.6.2", "status": "affected", "version": "2.5.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.6.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs."}], "id": "CVE-2026-115369", "lastModified": "2026-10-29T12:17:11.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115369", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T11:56:23.469465Z", "version": "2.0.3"}}]}, "published": "2026-10-22T19:17:43.243", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/openbao/openbao/security/advisories/GHSA-g892-p242-8g86"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/openbao-2.5.0-before-2.6.2-pki-allowed-ip-sans-cidr-bypass-via-csr-ip-sans"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/openbao/openbao: OpenBao: Unauthorized certificate issuance via CSR IP SAN validation bypass", "id": "2559339", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559339"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.", "A flaw was found in OpenBao. When processing a Certificate Signing Request (CSR) in the Public Key Infrastructure (PKI) engine, the service fails to enforce configured IP address restrictions against requested Subject Alternative Names (SAN). An authenticated remote user with certificate signing privileges can exploit this vulnerability by submitting a request containing restricted IP addresses. Successful exploitation allows the attacker to obtain trusted certificates for unauthorized network addresses, bypassing security controls."], "name": "CVE-2026-115369", "public_date": "2026-10-22T19:13:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115369\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115369\nhttps://github.com/openbao/openbao/security/advisories/GHSA-g892-p242-8g86\nhttps://www.vulncheck.com/advisories/openbao-2.5.0-before-2.6.2-pki-allowed-ip-sans-cidr-bypass-via-csr-ip-sans"], "statement": "This vulnerability is rated as Low severity because successful exploitation requires an authenticated attacker to possess explicit certificate signing privileges on a configured PKI role, substantially restricting the attack surface. Furthermore, OpenBao is not distributed or packaged in Red Hat enterprise products, meaning standard Red Hat environments are not affected. In custom standalone deployments, the impact is confined to issuing certificates containing out-of-range IP Subject Alternative Names, with no compromise of root Certificate Authority keys or underlying host integrity.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.5.0,2.6.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.6.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "openbao", "source": "cna", "vendor": "openbao"}, "product": "openbao", "vendor": "openbao"}], "created": "2026-10-23T03:45:16.531313+00:00", "updated": "2026-10-27T09:30:19.989396+00:00", "vendors": ["openbao", "openbao$PRODUCT$openbao"]}