{"schema":"threatline.record/2","record":{"id":"GHSA-7m59-mp95-w6ph","aliases":["GHSA-7m59-mp95-w6ph"],"summary":"OpenBao's AppRole SecretID is Usable Past Expiration","details":"## Impact\r\n\r\nIn OpenBao's AppRole authentication method, Secret IDs may have TTLs to force expiry. Normally these are tidied by the periodic ticker that executes once every minute. However, at time of use within the role system or during login, Secret IDs are not checked for expiration. This means any expired secret IDs that have not yet been removed may be used for login.\r\n\r\nThis vulnerability is original to HashiCorp Vault. \r\n\r\n## Patch\r\n\r\nThis vulnerability is patched in OpenBao v2.7.1 and v2.6.4.\r\n","categories":["Unclassified"],"product":"github.com/openbao/openbao/v2","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph","source_modified_at":"2026-10-01T14:29:38Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"go","name":"github.com/openbao/openbao/v2"},"range":"<2.7.1, <2.6.4"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph","source_modified_at":"2026-10-01T14:29:38Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"go","name":"github.com/openbao/openbao/v2"},"version":"2.7.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph","source_modified_at":"2026-10-01T14:29:38Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"go","name":"github.com/openbao/openbao/v2"},"version":"2.6.4"}],"cvss":2.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-01T14:29:38Z","modified_at":"2026-10-01T14:29:38Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-10-01T14:29:38Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-01T14:29:38Z","content_hash":"2a5ad32ace95534bf1ebb728d10032eed6eca9270a2c360c27b1d5f9ba8804b1"}}