All vulnerabilities
GHSA-5v22-543h-wg96

github.com/openbao/openbao/v2: OpenBao's Request Parsing Allow Bypassing Role-Based Rate Limit Quotas

github.com/openbao/openbao/v2
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.7.1Also 2.6.4GitHub
Published1 Oct 2026Updated 1 Oct 2026GitHub

What fixes it

  • 2.7.1github.com/openbao/openbao/v2, goGitHubgo get github.com/openbao/openbao/v2@v2.7.1
  • 2.6.4github.com/openbao/openbao/v2, goGitHubgo get github.com/openbao/openbao/v2@v2.6.4

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

OpenBao's rate limit quota subsystem supports quota rules scoped to backend-specific roles. When requests used form-encoded bodies or with forwarded certificates, callers could bypass enforcement of such rules by failing role resolution. Valid callers could therefore issue repeated tokens without consuming the configured role-based rate limit budget.

This vulnerability is original to HashiCorp Vault.

Patch

This vulnerability is patched in OpenBao v2.7.1 and v2.6.4.

Text from GitHub Advisory Database

Affected versions 1

  • github.com/openbao/openbao/v2, go<2.7.1, <2.6.4GitHub