BIT-openbao-2026-115363: OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tlsacmeeabmackey value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.7.1 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running OpenBao 2.2.0 through versions before 2.6.4, or 2.7.0 through versions before 2.7.1, are affected when they use an ACME External Account Binding MAC key for TLS listener certificates.
What access does an attacker need?
An attacker must be able to call the sys/config/state/sanitized endpoint. Successful exploitation allows retrieval of the tls_acme_eab_mac_key value.
How can I determine whether the key may have been exposed?
Review whether callers have accessed the sys/config/state/sanitized endpoint on an affected OpenBao version. If the deployment uses tls_acme_eab_mac_key, responses from that endpoint could disclose the key.
What should be prioritized for remediation?
Upgrade affected 2.2.x through pre-2.6.4 deployments to 2.6.4 or later, and affected 2.7.0 deployments to 2.7.1 or later. Because disclosure permits binding to the operator's ACME account, assess whether the exposed MAC key should be replaced.