BIT-openbao-2026-115369: OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowedipsanscidr restriction on IP SANs taken from a CSR when usecsrsans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.2 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.2
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
Affected deployments are OpenBao versions from 2.5.0 before 2.6.2 that use PKI roles with allowed_ip_sans_cidr configured and use_csr_sans enabled. The issue applies to the pki/sign/<role> signing endpoint.
What access does an attacker need?
An attacker must be authenticated and have sign permission for the relevant PKI role. They can then submit a CSR containing an IP SAN outside the role's allowed_ip_sans_cidr range.
What is the impact of successful exploitation?
A successful attacker can obtain a CA-signed certificate containing unauthorized IP addresses. The vulnerability affects integrity; no confidentiality or availability impact is identified in the provided severity vector.