CVE-2026-77285: Go/github.com/openbao/openbao vulnerability
Impact
During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in envtemplate to stdout. This primarily happens when numretries is met.
This vulnerability is original to Vault and was reported via the OpenBao security mailing list.
Patches
This is addressed in OpenBao v2.6.0 GA.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/openbao/openbaoto a version that resolves this vulnerability.Fixed in 0.0.0-20260714163218-90272575e5f5 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenBao Agent deployments using exec rendering mode with secrets configured through env_template are exposed under certain error conditions. The issue primarily occurs when the configured num_retries limit is reached.
What does an attacker need to exploit this?
The available information does not describe an external attacker interaction or prerequisite. The disclosed impact is that secrets from env_template can be written to stdout when the relevant error and retry condition occurs.
How can I determine whether secrets may already have been exposed?
Review stdout captured from OpenBao Agent instances using exec rendering mode, especially around errors where num_retries was met. Check whether those agents use env_template to supply secrets.
What should be done to remediate the issue?
Upgrade to OpenBao v2.6.0 GA, which addresses the issue. If secrets may have been written to stdout, treat any affected output locations as potential secret exposure and investigate them.