All vulnerabilities
GHSA-7m59-mp95-w6ph

github.com/openbao/openbao/v2: OpenBao's AppRole SecretID is Usable Past Expiration

github.com/openbao/openbao/v2
Open in ThreatlineRecord JSON
CVSS
2.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.7.1Also 2.6.4GitHub
Published1 Oct 2026Updated 1 Oct 2026GitHub

What fixes it

  • 2.7.1github.com/openbao/openbao/v2, goGitHubgo get github.com/openbao/openbao/v2@v2.7.1
  • 2.6.4github.com/openbao/openbao/v2, goGitHubgo get github.com/openbao/openbao/v2@v2.6.4

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

In OpenBao's AppRole authentication method, Secret IDs may have TTLs to force expiry. Normally these are tidied by the periodic ticker that executes once every minute. However, at time of use within the role system or during login, Secret IDs are not checked for expiration. This means any expired secret IDs that have not yet been removed may be used for login.

This vulnerability is original to HashiCorp Vault.

Patch

This vulnerability is patched in OpenBao v2.7.1 and v2.6.4.

Text from GitHub Advisory Database

Affected versions 1

  • github.com/openbao/openbao/v2, go<2.7.1, <2.6.4GitHub