Vulnerabilidades em openbao
44 resultadosAnálise Vexday
OpenBao possui 21 vulnerabilidades no registro com 3 críticas, mas nenhuma sob exploração ativa conhecida. A fraqueza predominante (CWE-532: Log Information Disclosure) sugere exposição de dados sensíveis em logs, risco moderado para ambientes com auditoria rigorosa. O volume reduzido de descobertas recentes (1 em 90 dias) indica maturidade relativa do produto, mas exige atenção contínua às críticas catalogadas.
CVE-2026-40264LOWOpenBao's Token Store Allows Cross-Namespace Renewal, RevocationEPSS 0.3%CVE-2026-33758CRITICALOpenBao has Reflected XSS in its OIDC authentication error messageEPSS 0.3%CVE-2025-55003MEDIUMOpenBao Login MFA Bypasses Rate Limiting and TOTP Token ReuseEPSS 0.3%CVE-2025-59048HIGHOpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth MethodEPSS 0.3%CVE-2026-115360MEDIUMOpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UIEPSS 0.2%CVE-2026-42186LOWOpenBao's Namespace Deletion May Not Delete Data ProperlyEPSS 0.2%CVE-2025-55001MEDIUMOpenBao LDAP MFA Enforcement Bypass When Using Username As AliasEPSS 0.2%CVE-2025-55000MEDIUMOpenBao TOTP Secrets Engine Enables Code ReuseEPSS 0.2%CVE-2026-39946MEDIUMOpenBao allows SQL Injection in PostgreSQL database secrets engineEPSS 0.2%CVE-2025-54998MEDIUMOpenBao Userpass and LDAP User Lockout BypassEPSS 0.2%CVE-2026-39396LOWOpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)EPSS 0.2%CVE-2025-54999LOWOpenBao: Timing Side-Channel in Userpass Auth MethodEPSS 0.2%CVE-2026-115356MEDIUMOpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After RevocationEPSS 0.2%CVE-2026-115357LOWOpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey ResponsesEPSS 0.2%CVE-2026-46358MEDIUMOpenBao's Inline Auth Incorrectly Redacted HeadersEPSS 0.2%CVE-2026-115361LOWOpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy DenialEPSS 0.2%CVE-2026-115362LOWOpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication BypassEPSS 0.2%CVE-2026-115358LOWOpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed ParametersEPSS 0.2%CVE-2026-115359MEDIUMOpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request ParsingEPSS 0.2%CVE-2026-115366LOWOpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIsEPSS 0.2%