CVE-2026-115369: OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs

Q: Who can exploit this issue?

An authenticated caller must have sign permission for the affected PKI role. The issue is limited to roles with use_csr_sans enabled and an allowed_ip_sans_cidr restriction configured.

Q: What does an attacker need to submit?

The attacker needs to submit a certificate signing request containing an IP SAN outside the role's allowed_ip_sans_cidr range to the pki/sign/<role> endpoint. If successful, OpenBao signs a certificate for that unauthorized IP.

Published Oct 22, 2026

Updated

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowedipsanscidr restriction on IP SANs taken from a CSR when usecsrsans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.

Affected Software

1 affected component

OpenBao OpenBao>=2.5.0<2.6.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.6.2

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated caller must have sign permission for the affected PKI role. The issue is limited to roles with use_csr_sans enabled and an allowed_ip_sans_cidr restriction configured.

What does an attacker need to submit?

The attacker needs to submit a certificate signing request containing an IP SAN outside the role's allowed_ip_sans_cidr range to the pki/sign/<role> endpoint. If successful, OpenBao signs a certificate for that unauthorized IP.

Are default PKI role configurations affected?

The described bypass requires both use_csr_sans and allowed_ip_sans_cidr to be configured on the PKI role. The provided information does not establish whether those settings are enabled by default.

Which versions are affected?

OpenBao versions from 2.5.0 before 2.6.2 are affected. Upgrading to 2.6.2 or later addresses the affected version range.

CVE-2026-115369: OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to submit?

Are default PKI role configurations affected?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to submit?

Are default PKI role configurations affected?

Which versions are affected?