All vulnerabilities
GHSA-3237-j65r-m5rp

github.com/openbao/openbao/v2: OpenBao's Sanitized Configuration Discloses ACME EAB MAC Key

github.com/openbao/openbao/v2
Open in ThreatlineRecord JSON
CVSS
2.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.7.1Also 2.6.4GitHub
Published1 Oct 2026Updated 1 Oct 2026GitHub

What fixes it

  • 2.7.1github.com/openbao/openbao/v2, goGitHubgo get github.com/openbao/openbao/v2@v2.7.1
  • 2.6.4github.com/openbao/openbao/v2, goGitHubgo get github.com/openbao/openbao/v2@v2.6.4

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

When an OpenBao operator uses External Account Bindings (EAB) with Automatic Certificate Management Environment (ACME - RFC 8555) for certificate acquisition on TLS-enabled listeners, the sensitive tls_acme_eab_mac_key value was disclosed to callers of the sys/config/state/sanitized endpoint.

Patch

This vulnerability is patched in OpenBao v2.7.1 and v2.6.4.

Text from GitHub Advisory Database

Affected versions 1

  • github.com/openbao/openbao/v2, go<2.7.1, <2.6.4GitHub