BIT-openbao-2026-115357: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses
OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are OpenBao before 2.6.4 and version 2.7.0. The issue applies when request audit logging succeeds but response audit logging fails for the unauthenticated sys/generate-root, sys/rekey, or sys/rekey-recovery-key endpoints.
What does an attacker need to exploit this issue?
An attacker needs to use one of the affected unauthenticated endpoints and encounter the condition where response audit logging fails after request audit logging has succeeded. The impact is incomplete auditing of root token generation or rekey activity, rather than a stated direct confidentiality or availability impact.
How can teams identify possible exposure or past abuse?
Review audit records for requests to sys/generate-root, sys/rekey, and sys/rekey-recovery-key that do not have corresponding response entries. Such gaps may indicate operations whose response audit records were not written.
What versions address the issue?
Upgrade to OpenBao 2.6.4 or later in the 2.6 release line, or to 2.7.1 or later in the 2.7 release line.