CVE-2026-77285: OpenBao Agent information disclosure via stdout in exec rendering mode

CVE-2026-77285 · Severity: medium · CVSS 4 · Published 2026-09-23

OpenBao Agent is a credential injection tool that authenticates to a secrets vault and injects credentials into child processes. Under certain error conditions when retry limits are exceeded, the Agent's exec rendering mode incorrectly writes sensitive secrets configured in environment templates to stdout, where they may be captured by logs or monitoring systems. This could expose credentials to unauthorized personnel with access to application logs.

Technologies: github.com/openbao/openbao (Go). Vendors: Go.

Quick answers

Is CVE-2026-77285 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77285 being exploited in the wild.
How severe is CVE-2026-77285?
Medium severity, with a CVSS score of 4, published 23 September 2026.
Which products and versions are affected?
github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260714163218-90272575e5f5, SEMVER:introduced=0,fixed=0.0.0-20260714163218-90272575e5f5,introduced=0.1.0.
Is there a fix for CVE-2026-77285?
Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260714163218-90272575e5f5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77285 attacked?
It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-77285?
Check whether you run github.com/openbao/openbao (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/openbao/openbao (Go): upgrade to 0.0.0-20260714163218-90272575e5f5 or later
    go get github.com/openbao/openbao@v0.0.0-20260714163218-90272575e5f5

Technical details

This is an information disclosure vulnerability (CWE-532: Insertion of Sensitive Information into Log File) in OpenBao Agent's exec rendering mode. When configured with `env_template` settings and error conditions trigger retry limit exhaustion (`num_retries`), the Agent writes unencrypted secret values to stdout instead of securely injecting them into the child process environment. The vulnerability requires local access to the machine running OpenBao Agent, high privileges on that system, and active user interaction to trigger the error condition. An attacker with these preconditions can capture credential material from stdout/logs. The fix is available in OpenBao v2.6.0 GA and later.

Affected products

  • OpenBao Agent <2.6.0

Identifiers

  • CVE-2026-77285
  • BIT-OPENBAO-2026-77285
  • GHSA-444v-8vxr-p36h
  • GO-2026-6554

Timeline

  • 2026-07-14: disclosed
  • 2026-09-22: advisory
  • 2026-09-22: patched: Fixed in OpenBao v2.6.0 GA

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.