GHSA-5v22-543h-wg96: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.7.1 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running OpenBao before 2.6.4 or version 2.7.0 are affected. Exposure depends on using rate-limit quota rules scoped to backend-specific roles.
What does an attacker need to exploit the bypass?
The attacker must be a valid caller. They must issue requests that use form-encoded bodies or forwarded certificates, which can cause role resolution to fail for the quota check.
What is the practical impact of a successful bypass?
A valid caller can repeatedly issue tokens without consuming the configured role-based rate-limit budget. This defeats the intended quota enforcement and can increase the availability impact of token issuance activity.