# OpenBao vulnerabilities Source: https://junglewise.ai/threats/technologies/openbao Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 00:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/openbao.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 24 vulnerabilities in OpenBao: 0 in the last 7 days and 11 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115365, was published on 22 October 2026. 4 vulnerabilities in the last four weeks, down 43% on the four before (7). 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 4 - Last 90 days: 11 - All time: 24 (2 critical, 0 exploited in the wild) ## About OpenBao OpenBao is an open-source secrets management system forked from HashiCorp Vault. ## Latest OpenBao vulnerabilities - [CVE-2026-115365: OpenBao policy cache incorrect authorization via namespace traversal](https://junglewise.ai/threats/cve-2026-115365-openbao-from-2-3-0-before-2-6-3-contains-an-incorrect) (medium, CVSS 6.6, published 22 Oct 2026) - [CVE-2026-115361: OpenBao ACL bypass in policy denial evaluation](https://junglewise.ai/threats/cve-2026-115361-openbao-before-2-6-3-contains-an-acl-bypass-vulnerability-that) (medium, CVSS 4.1, published 22 Oct 2026) - [CVE-2026-115360: OpenBao open redirect in OIDC UI](https://junglewise.ai/threats/cve-2026-115360-openbao-before-2-6-3-contains-an-open-redirect-vulnerability-in) (medium, CVSS 4.7, published 22 Oct 2026) - [CVE-2026-115356: OpenBao Kubernetes Auth token renewal on revoked credentials](https://junglewise.ai/threats/cve-2026-115356-openbao-before-2-6-4-and-2-7-x-before-2-7-1-does-not-verify-when) (medium, CVSS 5.4, published 22 Oct 2026) - [CVE-2026-63132: OpenBao recovery mode timing attack token leakage](https://junglewise.ai/threats/cve-2026-63132-openbao-recovery-mode-timing-attack-token-leakage) (critical, CVSS 4, published 23 Sep 2026) - [CVE-2026-63131: OpenBao authorization bypass in policy enforcement for LIST operations](https://junglewise.ai/threats/cve-2026-63131-openbao-authorization-bypass-in-policy-enforcement-for-list) (medium, CVSS 4, published 23 Sep 2026) - [CVE-2026-71543: OpenBao templated policies privilege escalation via wildcard characters](https://junglewise.ai/threats/cve-2026-71543-openbao-templated-policies-privilege-escalation-via-wildcard) (high, CVSS 4, published 21 Sep 2026) - [CVE-2026-55776: OpenBao denial of service via Transit engine key creation](https://junglewise.ai/threats/cve-2026-55776-openbao-denial-of-service-via-transit-engine-key-creation) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-55775: OpenBao improper authorization in System Backend namespace management](https://junglewise.ai/threats/cve-2026-55775-openbao-improper-authorization-in-system-backend-namespace) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-55774: OpenBao cross-namespace lease revocation and renewal bypass](https://junglewise.ai/threats/cve-2026-55774-openbao-cross-namespace-lease-revocation-and-renewal-bypass) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-55770: OpenBao LDAP injection in ldaputil search filter construction](https://junglewise.ai/threats/cve-2026-55770-openbao-ldap-injection-in-ldaputil-search-filter-construction) (medium, CVSS 6.8, published 15 Sep 2026) - [CVE-2026-46405: OpenBao Kerberos auth method orphaned token accumulation](https://junglewise.ai/threats/cve-2026-46405-openbao-kerberos-auth-method-orphaned-token-accumulation) (medium, CVSS 5.3, published 28 May 2026) - [CVE-2026-46358: OpenBao sensitive information disclosure in audit logs](https://junglewise.ai/threats/cve-2026-46358-openbao-sensitive-information-disclosure-in-audit-logs) (medium, CVSS 4, published 28 May 2026) - [CVE-2026-45808: OpenBao authorization bypass in sys/revoke and sys/renew endpoints](https://junglewise.ai/threats/cve-2026-45808-openbao-authorization-bypass-in-sys-revoke-and-sys-renew) (high, CVSS 4, published 28 May 2026) - [CVE-2026-42186: OpenBao improper data removal during namespace deletion retry](https://junglewise.ai/threats/cve-2026-42186-openbao-improper-data-removal-during-namespace-deletion-retry) (high, CVSS 7.5, published 14 May 2026) - [CVE-2026-40264: OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation](https://junglewise.ai/threats/cve-2026-40264-openbao-s-token-store-allows-cross-namespace-renewal-revocation) (medium, CVSS 4, published 21 Apr 2026) - [CVE-2026-39946: OpenBao's SQL Injection in PostgreSQL database secrets engine](https://junglewise.ai/threats/cve-2026-39946-openbao-s-sql-injection-in-postgresql-database-secrets-engine) (medium, CVSS 4.9, published 21 Apr 2026) - [CVE-2026-39396: OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)](https://junglewise.ai/threats/cve-2026-39396-openbao-decompression-bomb-via-unbounded-copy-in-oci-plugin) (low, CVSS 3.1, published 21 Apr 2026) - [CVE-2026-39388: OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate](https://junglewise.ai/threats/cve-2026-39388-openbao-s-certificate-authentication-allows-token-renewal-with) (low, CVSS 3.1, published 21 Apr 2026) - [CVE-2026-33758: OpenBao reflected XSS in OIDC authentication callback](https://junglewise.ai/threats/cve-2026-33758-openbao-reflected-xss-in-oidc-authentication-callback) (medium, CVSS 6.1, published 27 Mar 2026) - [CVE-2026-33757: OpenBao session fixation via OIDC direct callback mode](https://junglewise.ai/threats/cve-2026-33757-openbao-session-fixation-via-oidc-direct-callback-mode) (critical, CVSS 9.6, published 27 Mar 2026) - [CVE-2025-64761: GO-2025-4156 - OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-64761-openbao-is-vulnerable-to-privileged-operator-identity-group-root) (high, CVSS 7.2, published 25 Nov 2025) - [CVE-2025-62705: GO-2025-4052 - OpenBao and Vault Leak byte Fields in Audit Logs in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-62705-openbao-and-vault-leak-byte-fields-in-audit-logs) (medium, CVSS 4.9, published 22 Oct 2025) - [CVE-2025-62513: GO-2025-4049 - OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-62513-openbao-leaks-httprawbody-in-audit-logs) (high, CVSS 7.5, published 22 Oct 2025) ## Most severe OpenBao vulnerabilities - [CVE-2026-33757: OpenBao session fixation via OIDC direct callback mode](https://junglewise.ai/threats/cve-2026-33757-openbao-session-fixation-via-oidc-direct-callback-mode) (critical, CVSS 9.6, published 27 Mar 2026) - [CVE-2026-63132: OpenBao recovery mode timing attack token leakage](https://junglewise.ai/threats/cve-2026-63132-openbao-recovery-mode-timing-attack-token-leakage) (critical, CVSS 4, published 23 Sep 2026) - [CVE-2026-42186: OpenBao improper data removal during namespace deletion retry](https://junglewise.ai/threats/cve-2026-42186-openbao-improper-data-removal-during-namespace-deletion-retry) (high, CVSS 7.5, published 14 May 2026) - [CVE-2025-62513: GO-2025-4049 - OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-62513-openbao-leaks-httprawbody-in-audit-logs) (high, CVSS 7.5, published 22 Oct 2025) - [CVE-2025-64761: GO-2025-4156 - OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation in github.com/openbao/openbao](https://junglewise.ai/threats/cve-2025-64761-openbao-is-vulnerable-to-privileged-operator-identity-group-root) (high, CVSS 7.2, published 25 Nov 2025) - [CVE-2026-45808: OpenBao authorization bypass in sys/revoke and sys/renew endpoints](https://junglewise.ai/threats/cve-2026-45808-openbao-authorization-bypass-in-sys-revoke-and-sys-renew) (high, CVSS 4, published 28 May 2026) - [CVE-2026-71543: OpenBao templated policies privilege escalation via wildcard characters](https://junglewise.ai/threats/cve-2026-71543-openbao-templated-policies-privilege-escalation-via-wildcard) (high, CVSS 4, published 21 Sep 2026) - [CVE-2026-55770: OpenBao LDAP injection in ldaputil search filter construction](https://junglewise.ai/threats/cve-2026-55770-openbao-ldap-injection-in-ldaputil-search-filter-construction) (medium, CVSS 6.8, published 15 Sep 2026) - [CVE-2026-115365: OpenBao policy cache incorrect authorization via namespace traversal](https://junglewise.ai/threats/cve-2026-115365-openbao-from-2-3-0-before-2-6-3-contains-an-incorrect) (medium, CVSS 6.6, published 22 Oct 2026) - [CVE-2026-55776: OpenBao denial of service via Transit engine key creation](https://junglewise.ai/threats/cve-2026-55776-openbao-denial-of-service-via-transit-engine-key-creation) (medium, CVSS 6.5, published 15 Sep 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, down 43% on the four before (7). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 3 | 1 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OpenBao vulnerabilities", https://junglewise.ai/threats/technologies/openbao, 12 November 2026.