CVE-2026-115356
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the…
- Risk score
- 44/100
- CVSS
- 5.4 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.6.4, 2.7 or 2.7.1 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.4 medium
- On your watchlist: kubernetes
References
Original description
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.
Last activity 22 Oct 2026. Patch Forecast updates every hour.