github.com/openbao/openbao vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55776Mediumgithub.com/openbao/openbao: OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesCVE-2026-55775Lowgithub.com/openbao/openbao: OpenBao's System Backend allows Unauthorized Management of the containing NamespaceCVE-2026-55774Lowgithub.com/openbao/openbao: OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808CVE-2026-55770Mediumgithub.com/openbao/openbao: OpenBao: LDAPi ldaputil (wrong escape func)CVE-2026-46405Mediumgithub.com/openbao/openbao: OpenBao's Kerberos Auth Method Accumulates Unaccessible TokensCVE-2026-46358Mediumgithub.com/openbao/openbao: OpenBao's Inline Auth Incorrectly Redacted HeadersCVE-2026-45808Highgithub.com/openbao/openbao: OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACLCVE-2026-42186Lowgithub.com/openbao/openbao: OpenBao's Namespace Deletion May Not Delete Data ProperlyCVE-2026-40264Lowgithub.com/openbao/openbao: OpenBao's Token Store Allows Cross-Namespace Renewal, RevocationCVE-2026-39946Mediumgithub.com/openbao/openbao: OpenBao's SQL Injection in PostgreSQL database secrets engineCVE-2026-39396Lowgithub.com/openbao/openbao: OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)CVE-2026-39388Lowgithub.com/openbao/openbao: OpenBao's Certificate Authentication Allows Token Renewal With Different CertificateCVE-2026-33758Criticalgithub.com/openbao/openbao: OpenBao has Reflected XSS in its OIDC authentication error messageCVE-2026-33757Criticalgithub.com/openbao/openbao: OpenBao lacks user confirmation for OIDC direct callback modeCVE-2025-64761Highgithub.com/openbao/openbao: OpenBao is Vulnerable to Privileged Operator Identity Group Root EscalationCVE-2025-62705Mediumgithub.com/openbao/openbao: OpenBao and Vault Leak []byte Fields in Audit Logs CVE-2025-62513Mediumgithub.com/openbao/openbao: OpenBao leaks HTTPRawBody in Audit LogsCVE-2025-59043Highgithub.com/openbao/openbao: OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requestsCVE-2025-55001Mediumgithub.com/openbao/openbao: OpenBao LDAP MFA Enforcement Bypass When Using Username As AliasCVE-2025-55003Mediumgithub.com/openbao/openbao: OpenBao Login MFA Bypass of Rate Limiting and TOTP Token ReuseCVE-2025-55000Mediumgithub.com/openbao/openbao: OpenBao TOTP Secrets Engine Code ReuseCVE-2025-54999Lowgithub.com/openbao/openbao: OpenBao has a Timing Side-Channel in the Userpass Auth MethodCVE-2025-54998Mediumgithub.com/openbao/openbao: OpenBao Userpass and LDAP User Lockout BypassCVE-2025-54997Criticalgithub.com/openbao/openbao: Privileged OpenBao Operator May Execute Code on the Underlying HostCVE-2025-54996Highgithub.com/openbao/openbao: OpenBao Root Namespace Operator May Elevate Token Privileges

Stop the waste.
Protect your environment with Kodem.