# github.com/openbao/openbao (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-openbao-openbao Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-openbao-openbao.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 33 vulnerabilities in github.com/openbao/openbao (Go): 0 in the last 7 days and 8 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77285, was published on 23 September 2026. Nothing in the last four weeks, down from 8 vulnerabilities in the four before. 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 8 - All time: 33 (2 critical, 0 exploited in the wild) ## About github.com/openbao/openbao (Go) Secrets management and encryption system compatible with HashiCorp Vault. ## Latest github.com/openbao/openbao (Go) vulnerabilities - [CVE-2026-77285: OpenBao Agent information disclosure via stdout in exec rendering mode](https://junglewise.ai/threats/cve-2026-77285-openbao-agent-information-disclosure-via-stdout-in-exec-rendering) (medium, CVSS 4, published 23 Sep 2026) - [CVE-2026-63132: OpenBao recovery mode timing attack token leakage](https://junglewise.ai/threats/cve-2026-63132-openbao-recovery-mode-timing-attack-token-leakage) (critical, CVSS 4, published 23 Sep 2026) - [CVE-2026-63131: OpenBao authorization bypass in policy enforcement for LIST operations](https://junglewise.ai/threats/cve-2026-63131-openbao-authorization-bypass-in-policy-enforcement-for-list) (medium, CVSS 4, published 23 Sep 2026) - [CVE-2026-71543: OpenBao templated policies privilege escalation via wildcard characters](https://junglewise.ai/threats/cve-2026-71543-openbao-templated-policies-privilege-escalation-via-wildcard) (high, CVSS 4, published 21 Sep 2026) - [CVE-2026-55776: OpenBao denial of service via Transit engine key creation](https://junglewise.ai/threats/cve-2026-55776-openbao-denial-of-service-via-transit-engine-key-creation) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-55775: OpenBao improper authorization in System Backend namespace management](https://junglewise.ai/threats/cve-2026-55775-openbao-improper-authorization-in-system-backend-namespace) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-55774: OpenBao cross-namespace lease revocation and renewal bypass](https://junglewise.ai/threats/cve-2026-55774-openbao-cross-namespace-lease-revocation-and-renewal-bypass) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-55770: OpenBao LDAP injection in ldaputil search filter construction](https://junglewise.ai/threats/cve-2026-55770-openbao-ldap-injection-in-ldaputil-search-filter-construction) (medium, CVSS 6.8, published 15 Sep 2026) - [CVE-2026-46405: OpenBao Kerberos auth method orphaned token accumulation](https://junglewise.ai/threats/cve-2026-46405-openbao-kerberos-auth-method-orphaned-token-accumulation) (medium, CVSS 5.3, published 28 May 2026) - [CVE-2026-46358: OpenBao sensitive information disclosure in audit logs](https://junglewise.ai/threats/cve-2026-46358-openbao-sensitive-information-disclosure-in-audit-logs) (medium, CVSS 4, published 28 May 2026) - [CVE-2026-45808: OpenBao authorization bypass in sys/revoke and sys/renew endpoints](https://junglewise.ai/threats/cve-2026-45808-openbao-authorization-bypass-in-sys-revoke-and-sys-renew) (high, CVSS 4, published 28 May 2026) - [CVE-2026-42186: OpenBao improper data removal during namespace deletion retry](https://junglewise.ai/threats/cve-2026-42186-openbao-improper-data-removal-during-namespace-deletion-retry) (high, CVSS 7.5, published 14 May 2026) - [CVE-2026-40264: OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation](https://junglewise.ai/threats/cve-2026-40264-openbao-s-token-store-allows-cross-namespace-renewal-revocation) (medium, CVSS 4, published 21 Apr 2026) - [CVE-2026-39946: OpenBao's SQL Injection in PostgreSQL database secrets engine](https://junglewise.ai/threats/cve-2026-39946-openbao-s-sql-injection-in-postgresql-database-secrets-engine) (medium, CVSS 4.9, published 21 Apr 2026) - [CVE-2026-39396: OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)](https://junglewise.ai/threats/cve-2026-39396-openbao-decompression-bomb-via-unbounded-copy-in-oci-plugin) (low, CVSS 3.1, published 21 Apr 2026) - [CVE-2026-39388: OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate](https://junglewise.ai/threats/cve-2026-39388-openbao-s-certificate-authentication-allows-token-renewal-with) (low, CVSS 3.1, published 21 Apr 2026) - [CVE-2026-33758: OpenBao reflected XSS in OIDC authentication callback](https://junglewise.ai/threats/cve-2026-33758-openbao-reflected-xss-in-oidc-authentication-callback) (medium, CVSS 6.1, published 27 Mar 2026) - [CVE-2026-33757: OpenBao session fixation via OIDC direct callback mode](https://junglewise.ai/threats/cve-2026-33757-openbao-session-fixation-via-oidc-direct-callback-mode) (critical, CVSS 9.6, published 27 Mar 2026) - [CVE-2025-64761: GO-2025-4156 - OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-64761-openbao-is-vulnerable-to-privileged-operator-identity-group-root) (high, CVSS 7.2, published 25 Nov 2025) - [CVE-2025-59043: OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests](https://junglewise.ai/threats/cve-2025-59043-openbao-has-potential-denial-of-service-vulnerability-when) (low, CVSS 3.1, published 30 Oct 2025) - [CVE-2025-62705: GO-2025-4052 - OpenBao and Vault Leak byte Fields in Audit Logs in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-62705-openbao-and-vault-leak-byte-fields-in-audit-logs) (medium, CVSS 4.9, published 22 Oct 2025) - [CVE-2025-62513: GO-2025-4049 - OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-62513-openbao-leaks-httprawbody-in-audit-logs) (high, CVSS 7.5, published 22 Oct 2025) - [CVE-2025-54998: GO-2025-3855 - OpenBao Userpass and LDAP User Lockout Bypass in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-54998-openbao-userpass-and-ldap-user-lockout-bypass) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-54997: GO-2025-3858 - Privileged OpenBao Operator May Execute Code on the Underlying Host in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-54997-privileged-openbao-operator-may-execute-code-on-the-underlying) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-55003: GO-2025-3856 - OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-55003-openbao-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse) (low, CVSS 3.1, published 11 Aug 2025) ## Most severe github.com/openbao/openbao (Go) vulnerabilities - [CVE-2026-33757: OpenBao session fixation via OIDC direct callback mode](https://junglewise.ai/threats/cve-2026-33757-openbao-session-fixation-via-oidc-direct-callback-mode) (critical, CVSS 9.6, published 27 Mar 2026) - [CVE-2026-63132: OpenBao recovery mode timing attack token leakage](https://junglewise.ai/threats/cve-2026-63132-openbao-recovery-mode-timing-attack-token-leakage) (critical, CVSS 4, published 23 Sep 2026) - [CVE-2026-42186: OpenBao improper data removal during namespace deletion retry](https://junglewise.ai/threats/cve-2026-42186-openbao-improper-data-removal-during-namespace-deletion-retry) (high, CVSS 7.5, published 14 May 2026) - [CVE-2025-62513: GO-2025-4049 - OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-62513-openbao-leaks-httprawbody-in-audit-logs) (high, CVSS 7.5, published 22 Oct 2025) - [CVE-2025-64761: GO-2025-4156 - OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-64761-openbao-is-vulnerable-to-privileged-operator-identity-group-root) (high, CVSS 7.2, published 25 Nov 2025) - [CVE-2026-45808: OpenBao authorization bypass in sys/revoke and sys/renew endpoints](https://junglewise.ai/threats/cve-2026-45808-openbao-authorization-bypass-in-sys-revoke-and-sys-renew) (high, CVSS 4, published 28 May 2026) - [CVE-2026-71543: OpenBao templated policies privilege escalation via wildcard characters](https://junglewise.ai/threats/cve-2026-71543-openbao-templated-policies-privilege-escalation-via-wildcard) (high, CVSS 4, published 21 Sep 2026) - [CVE-2026-55770: OpenBao LDAP injection in ldaputil search filter construction](https://junglewise.ai/threats/cve-2026-55770-openbao-ldap-injection-in-ldaputil-search-filter-construction) (medium, CVSS 6.8, published 15 Sep 2026) - [CVE-2026-55776: OpenBao denial of service via Transit engine key creation](https://junglewise.ai/threats/cve-2026-55776-openbao-denial-of-service-via-transit-engine-key-creation) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-33758: OpenBao reflected XSS in OIDC authentication callback](https://junglewise.ai/threats/cve-2026-33758-openbao-reflected-xss-in-oidc-authentication-callback) (medium, CVSS 6.1, published 27 Mar 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 8 vulnerabilities in the four before. 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 4 | 1 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/openbao/openbao (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-openbao-openbao, 13 November 2026.