{"schema":"threatline.record/2","record":{"id":"GHSA-3237-j65r-m5rp","aliases":["GHSA-3237-j65r-m5rp"],"summary":"OpenBao's Sanitized Configuration Discloses ACME EAB MAC Key","details":"## Impact\r\n\r\nWhen an OpenBao operator uses External Account Bindings (EAB) with Automatic Certificate Management Environment (ACME - RFC 8555) for certificate acquisition on TLS-enabled listeners, the sensitive `tls_acme_eab_mac_key` value was disclosed to callers of the `sys/config/state/sanitized` endpoint.\r\n\r\n## Patch\r\n\r\nThis vulnerability is patched in OpenBao v2.7.1 and v2.6.4.","categories":["Unclassified"],"product":"github.com/openbao/openbao/v2","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp","source_modified_at":"2026-10-01T14:19:40Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"ecosystem":"go","name":"github.com/openbao/openbao/v2"},"range":"<2.7.1, <2.6.4"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp","source_modified_at":"2026-10-01T14:19:40Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"ecosystem":"go","name":"github.com/openbao/openbao/v2"},"version":"2.7.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp","source_modified_at":"2026-10-01T14:19:40Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"ecosystem":"go","name":"github.com/openbao/openbao/v2"},"version":"2.6.4"}],"cvss":2.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-01T14:19:40Z","modified_at":"2026-10-01T14:19:40Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp","fetched_at":"2026-10-23T19:00:29.328130Z","source_modified_at":"2026-10-01T14:19:40Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-01T14:19:40Z","content_hash":"6906267790500b1d0593e9ea1a709444738f029a1c780633ee28b7dfceb0bac0"}}