Executive brief
OpenBao, a tool for managing secrets and sensitive data, contains a flaw in its Kerberos authentication method. When certain authentication requests fail, the system inadvertently creates 'orphaned' security tokens that are not accessible to the user but remain in the system's storage. While these tokens cannot be used to access data, a large volume of failed requests could lead to excessive storage consumption and potential performance issues.
Technical details
A vulnerability in OpenBao's Kerberos auth method occurs when the GET handler or an 'Authorization: Negotiate' header is processed. The component incorrectly returns a 'logical.Auth' object alongside an error message, triggering the creation of a token with default policies and TTLs despite the authentication failure. These tokens are not returned to the caller and are only visible via 'sys/raw', but they persist in the backend storage. An unauthenticated remote attacker could repeatedly trigger this behavior to cause storage exhaustion (CWE-770). The issue is resolved in version 2.5.4 by ensuring the Kerberos auth method does not return an Auth block simultaneously with an error.
Affected products
- OpenBao OpenBao <= 2.5.3
Timeline
- 2026-05-20: patched: Fix merged in pull request 3150
- 2026-05-21: disclosed: Initial disclosure by maintainers
- 2026-05-28: advisory: GitHub Advisory published
References
- https://github.com/openbao/openbao/security/advisories/GHSA-7j6w-vvw2-5f9c
- https://github.com/openbao/openbao/pull/3150
- https://github.com/openbao/openbao/commit/0d82e0a5a3b6a93e8087bcbaf0b11326c12d4f4d
- https://github.com/openbao/openbao/releases/tag/v2.5.4
- https://api.github.com/repos/openbao/openbao/security-advisories/GHSA-7j6w-vvw2-5f9c