GHSA-444v-8vxr-p36h: Go/github.com/openbao/openbao vulnerability
Impact
During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in envtemplate to stdout. This primarily happens when numretries is met.
This vulnerability is original to Vault and was reported via the OpenBao security mailing list.
Patches
This is addressed in OpenBao v2.6.0 GA.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/openbao/openbaoto a version that resolves this vulnerability.Fixed in 0.0.0-20260714163218-90272575e5f5 - Upgrade
Upgrade
OpenBao Agentto a version that resolves this vulnerability.Fixed in v2.6.0
Event History
Frequently Asked Questions
Which deployments are exposed to secret disclosure?
OpenBao Agent deployments that use exec rendering mode and specify secrets in env_template are exposed under certain error conditions. The issue primarily occurs when num_retries is reached.
What can be done if upgrading cannot happen immediately?
The provided information does not identify a workaround. Reducing reliance on exec rendering mode or avoiding secrets in env_template may limit exposure, but this is not stated as a verified mitigation.
How can operators determine whether secrets may already have been exposed?
Review stdout captured from affected OpenBao Agent executions, particularly around errors where num_retries was met, for values rendered from env_template. The vulnerability causes those secrets to be written to stdout.
Which release addresses the issue?
The issue is addressed in OpenBao v2.6.0 GA.