CVE-2026-115363: OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

Q: Which deployments are affected?

Affected versions are OpenBao 2.2.0 through versions before 2.6.4, and OpenBao 2.7.0 through versions before 2.7.1. Exposure is relevant where TLS listener certificates use ACME External Account Binding with a configured tls_acme_eab_mac_key.

Q: What access does an attacker need to retrieve the key?

The attacker must be able to call the sys/config/state/sanitized endpoint. The provided information does not establish that this endpoint is accessible without authorization.

Q: What could an attacker do with the disclosed value?

A caller who retrieves the tls_acme_eab_mac_key can use it to bind to the operator's ACME account. The issue exposes the MAC key used for the TLS listener's ACME External Account Binding.

Q: How can I determine whether my instance is vulnerable?

Check whether the OpenBao version falls in either affected range and whether tls_acme_eab_mac_key is configured for TLS listener certificates. Also review which principals can call sys/config/state/sanitized, since that endpoint is the disclosure path.

Q: What remediation is identified by the affected-version ranges?

Upgrade the 2.2.x-to-2.6.x line to 2.6.4 or later, or upgrade the 2.7.x line to 2.7.1 or later. If the MAC key may have been exposed, the supplied data indicates it can be used to bind to the ACME account.

Published Oct 22, 2026

Updated

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tlsacmeeabmackey value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.

Affected Software

1 affected component

OpenBao OpenBao>=2.2.0<2.6.4, >=2.7.0<2.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.6.4
Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are OpenBao 2.2.0 through versions before 2.6.4, and OpenBao 2.7.0 through versions before 2.7.1. Exposure is relevant where TLS listener certificates use ACME External Account Binding with a configured tls_acme_eab_mac_key.

What access does an attacker need to retrieve the key?

The attacker must be able to call the sys/config/state/sanitized endpoint. The provided information does not establish that this endpoint is accessible without authorization.

What could an attacker do with the disclosed value?

A caller who retrieves the tls_acme_eab_mac_key can use it to bind to the operator's ACME account. The issue exposes the MAC key used for the TLS listener's ACME External Account Binding.

How can I determine whether my instance is vulnerable?

Check whether the OpenBao version falls in either affected range and whether tls_acme_eab_mac_key is configured for TLS listener certificates. Also review which principals can call sys/config/state/sanitized, since that endpoint is the disclosure path.

What remediation is identified by the affected-version ranges?

Upgrade the 2.2.x-to-2.6.x line to 2.6.4 or later, or upgrade the 2.7.x line to 2.7.1 or later. If the MAC key may have been exposed, the supplied data indicates it can be used to bind to the ACME account.

CVE-2026-115363: OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to retrieve the key?

What could an attacker do with the disclosed value?

How can I determine whether my instance is vulnerable?

What remediation is identified by the affected-version ranges?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to retrieve the key?

What could an attacker do with the disclosed value?

How can I determine whether my instance is vulnerable?

What remediation is identified by the affected-version ranges?