Dashboard / CVE-2026-115362

CVE-2026-115362

LOW
INFO Priority: 0.00 BB Relevance: 49/100
Published: 2026-10-22 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: None
AT: None
VC: None
VI: Low
VA: None

Description

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
openbao openbao 0 < 2.6.4

References & Advisories (2)

Bug Bounty Relevance

49 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

2.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.20%
Raw Score 0.001970
Percentile 9.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00197
2026-10-28
0.00197

Intelligence Sources

mitre ref →
nvd ref →

External Links