Dashboard / CVE-2026-115358

CVE-2026-115358

LOW
INFO Priority: 0.00 BB Relevance: 39/100
Published: 2026-10-22 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: Passive
AT: Present
VC: Low
VI: None
VA: None

Description

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
openbao openbao 0 < 2.6.3

References & Advisories (2)

Bug Bounty Relevance

39 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

2.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.19%
Raw Score 0.001950
Percentile 9.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00195
2026-10-28
0.00195

Intelligence Sources

mitre ref →
nvd ref →

External Links