Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by GitHub_M

CVE-2026-77285OpenBao Agent Writes Secrets to Stdout

Low 2.4

In plain English

A low-severity sensitive data in logs in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.4Low
Exploit odds (30 days)0.2%top 94.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/openbao/openbao0.0.0-20260714163218-90272575e5f5GHSA-444v-8vxr-p36h
Gogithub.com/openbao/openbaono fix listedGHSA-444v-8vxr-p36h
Gogithub.com/openbao/openbao0.0.0-20260714163218-90272575e5f5GO-2026-6554

Affected products (as reported)

VendorProductVersions
openbao openbao < 2.6.0

Weakness: CWE-532 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H

References