Advisoriesby IbisOpenBaoGHSA-444v-8vxr-p36h
OpenBao Agent Writes Secrets to Stdout
Fix: upgrade to 0.0.0-20260714163218-90272575e5f5 or later
Impact
During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in env_template to stdout. This primarily happens when num_retries is met.
This vulnerability is original to Vault and was reported via the OpenBao security mailing list.
Patches
This is addressed in OpenBao v2.6.0 GA.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | < 0.0.0-20260714163218-90272575e5f5 | 0.0.0-20260714163218-90272575e5f5 |
| >= 0.1.0, <= 1.1.5 | No fix yet |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-532
- Also known as
- BIT-openbao-2026-77285, CVE-2026-77285, GO-2026-6554
- github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h
- github.com/openbao/openbao/pull/3494
- github.com/openbao/openbao/pull/3495
- github.com/openbao/openbao/commit/90272575e5f58b3883fbb0ccb2238e9285722d1a
- github.com/openbao/openbao/commit/ee3aa4aff72c5176cf02af21eac7158899080878
- github.com/openbao/openbao
- github.com/openbao/openbao/releases/tag/v2.6.0
More OpenBao advisories
All OpenBao
OpenBao Skips Stricter Deny Policy for LIST operationsCVE-2026-63131fixed in 0.0.0-20260713133043-f58d848c139eOpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackCVE-2026-63132fixed in 0.0.0-20260713141742-763625a20721OpenBao's Templated Policies Allow Privilege Escalation via Wildcard CharactersCVE-2026-71543fixed in 0.0.0-20260710001938-2d4ebafec5c5OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesCVE-2026-55776fixed in 0.0.0-20260617104123-db57c62602b2OpenBao's System Backend allows Unauthorized Management of the containing NamespaceCVE-2026-55775fixed in 0.0.0-20260617103935-d3c1cc64b1aeOpenBao: improper authorizationCVE-2026-55774fixed in 0.0.0-20260617103932-b20b999dd404