CVE-2026-115356: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

Q: Which deployments are affected?

Deployments running OpenBao before 2.6.4, or version 2.7.0, are affected when they use the Kubernetes Auth method and issue renewable tokens through that method.

Q: What does an attacker need to exploit this issue?

The attacker must already be authenticated with a token issued through the Kubernetes Auth method. They can then renew that token after the Kubernetes service account originally used for authentication has been deleted.

Q: Does deleting the Kubernetes service account revoke the OpenBao token?

On affected versions, deleting the service account does not prevent renewal of an existing token issued through the Kubernetes Auth method. The token can be renewed to maintain access.

Q: How can I determine whether existing access may persist after service-account deletion?

Identify renewable OpenBao tokens issued through the Kubernetes Auth method and determine whether their originating Kubernetes service accounts have been deleted. On affected versions, those tokens may still be renewable.

Published Oct 22, 2026

Updated

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.

Affected Software

1 affected component

OpenBao OpenBao<2.6.4, >=2.7.0<2.7.1

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments running OpenBao before 2.6.4, or version 2.7.0, are affected when they use the Kubernetes Auth method and issue renewable tokens through that method.

What does an attacker need to exploit this issue?

The attacker must already be authenticated with a token issued through the Kubernetes Auth method. They can then renew that token after the Kubernetes service account originally used for authentication has been deleted.

Does deleting the Kubernetes service account revoke the OpenBao token?

On affected versions, deleting the service account does not prevent renewal of an existing token issued through the Kubernetes Auth method. The token can be renewed to maintain access.

How can I determine whether existing access may persist after service-account deletion?

Identify renewable OpenBao tokens issued through the Kubernetes Auth method and determine whether their originating Kubernetes service accounts have been deleted. On affected versions, those tokens may still be renewable.

CVE-2026-115356: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Does deleting the Kubernetes service account revoke the OpenBao token?

How can I determine whether existing access may persist after service-account deletion?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Does deleting the Kubernetes service account revoke the OpenBao token?

How can I determine whether existing access may persist after service-account deletion?