GHSA-q74w-hv5x-6hxf: OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses
Published Oct 22, 2026
·Updated
OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.
Affected Software
2 affected componentsFixes available
bitnami/openbao<2.6.4
2.6.4
bitnami/openbao>=2.7.0<2.7.1
2.7.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Oct 22, 2026
CVE Published
via OSV·07:13 PM
Data Sourced
via OSV·07:13 PM
DescriptionSeverityWeakness
Oct 29, 2026
Advisory Published
via OSV·08:54 AM
Data Sourced
via OSV·08:54 AM
Affected Software