BIT-openbao-2026-115359: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.7.1 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments running OpenBao before 2.6.4, or version 2.7.0, are affected when they use rate-limit quota rules scoped to backend-specific roles. The issue applies to requests with form-encoded bodies or forwarded certificates, where role resolution fails.
What does an attacker need to exploit the issue?
The attacker must be a valid caller able to repeatedly issue tokens through an affected request path. No additional privileges or user interaction are indicated, but the flaw bypasses role-based quota enforcement rather than authentication itself.
What is the practical impact?
Affected callers can issue tokens repeatedly without consuming the configured rate-limit budget for the relevant backend-specific role. This can defeat the availability protection intended to limit token issuance for that role.
What can be done if an update cannot be applied immediately?
The provided information does not specify a workaround. Prioritize upgrading to OpenBao 2.6.4 or later in the 2.6 line, or 2.7.1 or later in the 2.7 line, and review token issuance activity for roles protected by quota rules.