CVE-2026-115362: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

Q: Who can exploit this issue?

An attacker must possess an expired AppRole SecretID that has not yet been removed by the periodic tidy process. Exploitation also requires the attacker to authenticate through the AppRole auth method.

Q: Are deployments using AppRole affected by default?

Deployments are affected when an expired AppRole SecretID remains present because periodic tidy has not removed it. The issue allows that SecretID to remain usable beyond its configured TTL.

Q: What versions contain the fix?

The issue is fixed in OpenBao 2.6.4 and 2.7.1. Affected versions are releases before 2.6.4 and 2.7.0 before 2.7.1.

Published Oct 22, 2026

Updated

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.

Affected Software

1 affected component

OpenBao OpenBao<2.6.4, >=2.7.0<2.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.6.4
Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must possess an expired AppRole SecretID that has not yet been removed by the periodic tidy process. Exploitation also requires the attacker to authenticate through the AppRole auth method.

Are deployments using AppRole affected by default?

Deployments are affected when an expired AppRole SecretID remains present because periodic tidy has not removed it. The issue allows that SecretID to remain usable beyond its configured TTL.

What versions contain the fix?

The issue is fixed in OpenBao 2.6.4 and 2.7.1. Affected versions are releases before 2.6.4 and 2.7.0 before 2.7.1.

CVE-2026-115362: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are deployments using AppRole affected by default?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are deployments using AppRole affected by default?

What versions contain the fix?