# CVE-2026-39388: OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

Source: https://junglewise.ai/threats/cve-2026-39388-openbao-s-certificate-authentication-allows-token-renewal-with  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-39388 · Severity: low · CVSS 3.1 · Published 2026-04-21

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates.

Technologies: [github.com/openbao/openbao (Go)](https://junglewise.ai/threats/technologies/github-com-openbao-openbao), [OpenBao](https://junglewise.ai/threats/technologies/openbao). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenBao](https://junglewise.ai/threats/vendors/openbao).

## Quick answers

**Is CVE-2026-39388 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39388 being exploited in the wild.

**How severe is CVE-2026-39388?** Low severity, with a CVSS score of 3.1, published 21 April 2026.

**Which products and versions are affected?** github.com/openbao/openbao (Go) < 0.0.0-20260420160924-abe84e1af4c3, SEMVER:introduced=0,fixed=0.0.0-20260420160924-abe84e1af4c3.

**Is there a fix for CVE-2026-39388?** Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260420160924-abe84e1af4c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-39388?** Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openbao/openbao (Go): upgrade to 0.0.0-20260420160924-abe84e1af4c3 or later

  ```sh
  go get github.com/openbao/openbao@v0.0.0-20260420160924-abe84e1af4c3
  ```


## Affected products

- github.com/openbao/openbao (Go) < 0.0.0-20260420160924-abe84e1af4c3, SEMVER:introduced=0,fixed=0.0.0-20260420160924-abe84e1af4c3
- OpenBao

## Identifiers

- CVE-2026-39388
- GHSA-7ccv-rp6m-rffr
- GO-2026-5213

## References

- [https://api.github.com/users/jmecom](https://api.github.com/users/jmecom)
- [https://github.com/jmecom](https://github.com/jmecom)
- [https://api.github.com/users/jmecom/gists%7B/gist_id%7D](https://api.github.com/users/jmecom/gists%7B/gist_id%7D)
- [https://api.github.com/users/jmecom/repos](https://api.github.com/users/jmecom/repos)
- [https://avatars.githubusercontent.com/u/6612870?v=4](https://avatars.githubusercontent.com/u/6612870?v=4)
- [https://api.github.com/users/jmecom/events%7B/privacy%7D](https://api.github.com/users/jmecom/events%7B/privacy%7D)

## Related threats

- [OpenBao policy cache incorrect authorization via namespace traversal](https://junglewise.ai/threats/cve-2026-115365-openbao-from-2-3-0-before-2-6-3-contains-an-incorrect)
- [OpenBao ACL bypass in policy denial evaluation](https://junglewise.ai/threats/cve-2026-115361-openbao-before-2-6-3-contains-an-acl-bypass-vulnerability-that)
- [OpenBao Kubernetes Auth token renewal on revoked credentials](https://junglewise.ai/threats/cve-2026-115356-openbao-before-2-6-4-and-2-7-x-before-2-7-1-does-not-verify-when)
- [OpenBao Agent information disclosure via stdout in exec rendering mode](https://junglewise.ai/threats/cve-2026-77285-openbao-agent-information-disclosure-via-stdout-in-exec-rendering)
- [OpenBao recovery mode timing attack token leakage](https://junglewise.ai/threats/cve-2026-63132-openbao-recovery-mode-timing-attack-token-leakage)