{"schema":"threatline.record/2","record":{"id":"GHSA-5v22-543h-wg96","aliases":["GHSA-5v22-543h-wg96"],"summary":"OpenBao's Request Parsing Allow Bypassing Role-Based Rate Limit Quotas","details":"## Impact\r\n\r\nOpenBao's rate limit quota subsystem supports quota rules scoped to backend-specific roles. When requests used form-encoded bodies or with forwarded certificates, callers could bypass enforcement of such rules by failing role resolution. Valid callers could therefore issue repeated tokens without consuming the configured role-based rate limit budget.\r\n\r\nThis vulnerability is original to HashiCorp Vault. \r\n\r\n## Patch\r\n\r\nThis vulnerability is patched in OpenBao v2.7.1 and v2.6.4.","categories":["Unclassified"],"product":"github.com/openbao/openbao/v2","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/openbao/openbao/security/advisories/GHSA-5v22-543h-wg96","source_modified_at":"2026-10-01T14:27:43Z","fetched_at":"2026-10-25T01:05:06.841276Z","package":{"ecosystem":"go","name":"github.com/openbao/openbao/v2"},"range":"<2.7.1, <2.6.4"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/openbao/openbao/security/advisories/GHSA-5v22-543h-wg96","source_modified_at":"2026-10-01T14:27:43Z","fetched_at":"2026-10-25T01:05:06.841276Z","package":{"ecosystem":"go","name":"github.com/openbao/openbao/v2"},"version":"2.7.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/openbao/openbao/security/advisories/GHSA-5v22-543h-wg96","source_modified_at":"2026-10-01T14:27:43Z","fetched_at":"2026-10-25T01:05:06.841276Z","package":{"ecosystem":"go","name":"github.com/openbao/openbao/v2"},"version":"2.6.4"}],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-01T14:27:27Z","modified_at":"2026-10-01T14:27:43Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/openbao/openbao/security/advisories/GHSA-5v22-543h-wg96","fetched_at":"2026-10-25T01:05:06.841276Z","source_modified_at":"2026-10-01T14:27:43Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-01T14:27:43Z","content_hash":"2028b996b6f75e490b7431ff0e996243910eba043d28353bd891b1b1ac457d11"}}