CVE-2026-46405 | Medium | 5.3 | 2026-08-07 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an… |
CVE-2026-45808 | | | 2026-08-07 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who… |
CVE-2026-46358 | | | 2026-08-07 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log… |
CVE-2026-42186 | High | 7.5 | 2026-05-14 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to… |
CVE-2026-40264 | Low | 2.7 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who… |
CVE-2026-39946 | Medium | 4.9 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL databas… |
CVE-2026-39396 | Low | 3.1 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extra… |
CVE-2026-39388 | Low | 3.1 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal i… |
CVE-2026-33758 | Medium | 6.1 | 2026-03-27 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method e… |
CVE-2026-33757 | Critical | 9.6 | 2026-03-27 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via J… |
CVE-2025-64761 | High | 7.2 | 2025-11-25 | OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add… |
CVE-2025-59048 | High | 8.1 | 2025-10-23 | OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Imp… |
CVE-2025-62705 | Medium | 4.9 | 2025-10-22 | OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when releva… |
CVE-2025-62513 | High | 7.5 | 2025-10-22 | OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP b… |
CVE-2025-59043 | High | 7.5 | 2025-10-17 | OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more… |
CVE-2025-55003 | Medium | 5.7 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-55001 | Medium | 6.5 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-55000 | Medium | 6.5 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 thro… |
CVE-2025-54999 | Low | 3.7 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 thro… |
CVE-2025-54998 | Medium | 5.3 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 thro… |
CVE-2025-54997 | Critical | 9.1 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-54996 | High | 7.2 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-52894 | High | 7.5 | 2025-06-25 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0… |
CVE-2025-52893 | Medium | 4.5 | 2025-06-25 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0… |
CVE-2025-4166 | Medium | 4.5 | 2025-05-02 | Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submi… |
CVE-2024-8185 | High | 7.5 | 2024-10-31 | Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through mem… |
CVE-2024-9180 | High | 7.2 | 2024-10-10 | A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s r… |
CVE-2024-7594 | High | 7.5 | 2024-09-26 | Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH… |
CVE-2024-2048 | High | 8.1 | 2024-03-04 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as tr… |