CVE-2026-115359: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing

Q: Which deployments are exposed to this issue?

Deployments running OpenBao before 2.6.4, or version 2.7.0, are affected when they use rate-limit quota rules scoped to backend-specific roles.

Q: What does an attacker need to bypass the quota?

The attacker must be a valid caller and send requests with form-encoded bodies or forwarded certificates. The flaw causes role resolution to fail, preventing the applicable role-based quota rule from being enforced.

Q: What is the practical impact of successful exploitation?

A valid caller can repeatedly issue tokens without consuming the configured rate-limit budget for the relevant backend-specific role. The stated impact is availability-related rather than confidentiality or integrity loss.

Q: What versions address the issue?

Upgrade to OpenBao 2.6.4 or later in the 2.6 release line, or to 2.7.1 or later in the 2.7 release line.

Published Oct 22, 2026

Updated

OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.

Affected Software

1 affected component

OpenBao OpenBao<2.6.4, >=2.7.0<2.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.6.4
Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments running OpenBao before 2.6.4, or version 2.7.0, are affected when they use rate-limit quota rules scoped to backend-specific roles.

What does an attacker need to bypass the quota?

The attacker must be a valid caller and send requests with form-encoded bodies or forwarded certificates. The flaw causes role resolution to fail, preventing the applicable role-based quota rule from being enforced.

What is the practical impact of successful exploitation?

A valid caller can repeatedly issue tokens without consuming the configured rate-limit budget for the relevant backend-specific role. The stated impact is availability-related rather than confidentiality or integrity loss.

What versions address the issue?

Upgrade to OpenBao 2.6.4 or later in the 2.6 release line, or to 2.7.1 or later in the 2.7 release line.

CVE-2026-115359: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to bypass the quota?

What is the practical impact of successful exploitation?

What versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to bypass the quota?

What is the practical impact of successful exploitation?

What versions address the issue?