Log in Start free

Vulnerability · Published Aug 7, 2026 · Assigned by GitHub_M

CVE-2026-46358OpenBao's Inline Auth Incorrectly Redacted Headers

Medium 5.4

In plain English

A medium-severity sensitive data in logs in openbao from openbao. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.4Medium
Exploit odds (30 days)0.2%top 88.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23openbao2.5.4-r0ALPINE-CVE-2026-46358
Alpine:v3.24openbao2.5.4-r0ALPINE-CVE-2026-46358
Gogithub.com/openbao/openbao2.5.4GHSA-q8cj-789h-vg24
Gogithub.com/openbao/openbaono fix listedGO-2026-5574

Affected products (as reported)

VendorProductVersions
openbao openbao < 2.5.4

Weakness: CWE-532 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References