Advisoriesby IbisOpenBaoGHSA-q8cj-789h-vg24
OpenBao's Inline Auth Incorrectly Redacted Headers
Fix: upgrade to 2.5.4 or later
Impact
OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate.
Patches
This is fixed in OpenBao v2.5.4.
Resources
https://github.com/openbao/openbao/issues/3074
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | < 2.5.4 | 2.5.4 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-532
- Also known as
- BIT-openbao-2026-46358, CVE-2026-46358, GO-2026-5574
More OpenBao advisories
All OpenBao
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesCVE-2026-55776fixed in 0.0.0-20260617104123-db57c62602b2OpenBao's System Backend allows Unauthorized Management of the containing NamespaceCVE-2026-55775fixed in 0.0.0-20260617103935-d3c1cc64b1aeOpenBao: improper authorizationCVE-2026-55774fixed in 0.0.0-20260617103932-b20b999dd404OpenBao: LDAPi ldaputil (wrong escape func)CVE-2026-55770fixed in 0.0.0-20260617104213-10b7825c714cOpenBao's Kerberos Auth Method Accumulates Unaccessible TokensCVE-2026-46405fixed in 2.5.4OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACLCVE-2026-45808fixed in 2.5.4