BIT-openbao-2026-115356: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Kubernetes Auth method are affected if they run OpenBao before 2.6.4, or version 2.7.0. The issue concerns tokens issued through that authentication method.
What does an attacker need to exploit this?
The attacker must already be authenticated and possess a token issued by the Kubernetes Auth method. They can renew that token after the Kubernetes service account originally used to authenticate has been deleted.
Does deleting the Kubernetes service account immediately revoke existing OpenBao access?
Not on affected versions for renewable tokens issued through the Kubernetes Auth method. The service account's deletion is not checked during token renewal, allowing continued access through repeated renewals.
What versions address the issue?
OpenBao 2.6.4 and 2.7.1 address the affected version ranges. Versions before 2.6.4 and version 2.7.0 are affected.