GHSA-7m59-mp95-w6ph: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

Q: Who can exploit this issue?

An attacker must possess an AppRole SecretID that has expired but has not yet been removed by the periodic tidy process. They can then use that SecretID to authenticate and retain access beyond its configured TTL.

Q: Are all OpenBao deployments affected by default?

The issue applies to affected OpenBao versions when the AppRole authentication method is used and an expired SecretID remains untidied. Deployments that do not use AppRole SecretIDs are not exposed through this condition.

Q: What versions should be remediated?

Upgrade OpenBao to 2.6.4 or later in the 2.6 release line, or to 2.7.1 or later in the 2.7 release line. Versions before 2.6.4 and version 2.7.0 are affected.

Q: What can be done before upgrading?

Ensure the periodic tidy process removes expired AppRole SecretIDs promptly, reducing the window in which an expired SecretID can still authenticate. Treat any expired SecretID that has not yet been tidied as potentially usable for login.

Published Oct 22, 2026

Updated

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.

Affected Software

2 affected componentsFixes available

bitnami/openbao<2.6.4

2.6.4

bitnami/openbao>=2.7.0<2.7.1

2.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/openbao to a version that resolves this vulnerability.
Fixed in 2.6.4
Upgrade
Upgrade bitnami/openbao to a version that resolves this vulnerability.
Fixed in 2.7.1
Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.6.4
Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Oct 22, 2026

CVE Published

via OSV·07:13 PM

Data Sourced

via OSV·07:13 PM

DescriptionSeverityWeakness

Oct 29, 2026

Advisory Published

via OSV·08:54 AM

Data Sourced

via OSV·08:54 AM

Affected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must possess an AppRole SecretID that has expired but has not yet been removed by the periodic tidy process. They can then use that SecretID to authenticate and retain access beyond its configured TTL.

Are all OpenBao deployments affected by default?

The issue applies to affected OpenBao versions when the AppRole authentication method is used and an expired SecretID remains untidied. Deployments that do not use AppRole SecretIDs are not exposed through this condition.

What versions should be remediated?

Upgrade OpenBao to 2.6.4 or later in the 2.6 release line, or to 2.7.1 or later in the 2.7 release line. Versions before 2.6.4 and version 2.7.0 are affected.

What can be done before upgrading?

Ensure the periodic tidy process removes expired AppRole SecretIDs promptly, reducing the window in which an expired SecretID can still authenticate. Treat any expired SecretID that has not yet been tidied as potentially usable for login.

GHSA-7m59-mp95-w6ph: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are all OpenBao deployments affected by default?

What versions should be remediated?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are all OpenBao deployments affected by default?

What versions should be remediated?

What can be done before upgrading?