github.com/openbao/openbao vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-63131Mediumgithub.com/openbao/openbao: OpenBao Skips Stricter Deny Policy for LIST operationsCVE-2026-63132Criticalgithub.com/openbao/openbao: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackCVE-2026-71543Highgithub.com/openbao/openbao: OpenBao's Templated Policies Allow Privilege Escalation via Wildcard CharactersCVE-2026-77285Lowgithub.com/openbao/openbao: OpenBao Agent Writes Secrets to StdoutCVE-2026-55776Mediumgithub.com/openbao/openbao: OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesCVE-2026-55775Lowgithub.com/openbao/openbao: OpenBao's System Backend allows Unauthorized Management of the containing NamespaceCVE-2026-55774Lowgithub.com/openbao/openbao: OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808CVE-2026-55770Mediumgithub.com/openbao/openbao: OpenBao: LDAPi ldaputil (wrong escape func)CVE-2026-46405Mediumgithub.com/openbao/openbao: OpenBao's Kerberos Auth Method Accumulates Unaccessible TokensCVE-2026-46358Mediumgithub.com/openbao/openbao: OpenBao's Inline Auth Incorrectly Redacted HeadersCVE-2026-45808Highgithub.com/openbao/openbao: OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACLCVE-2026-42186Lowgithub.com/openbao/openbao: OpenBao's Namespace Deletion May Not Delete Data ProperlyCVE-2026-40264Lowgithub.com/openbao/openbao: OpenBao's Token Store Allows Cross-Namespace Renewal, RevocationCVE-2026-39946Mediumgithub.com/openbao/openbao: OpenBao's SQL Injection in PostgreSQL database secrets engineCVE-2026-39396Lowgithub.com/openbao/openbao: OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)CVE-2026-39388Lowgithub.com/openbao/openbao: OpenBao's Certificate Authentication Allows Token Renewal With Different CertificateCVE-2026-33758Criticalgithub.com/openbao/openbao: OpenBao has Reflected XSS in its OIDC authentication error messageCVE-2026-33757Criticalgithub.com/openbao/openbao: OpenBao lacks user confirmation for OIDC direct callback modeCVE-2025-64761Highgithub.com/openbao/openbao: OpenBao is Vulnerable to Privileged Operator Identity Group Root EscalationCVE-2025-62705Mediumgithub.com/openbao/openbao: OpenBao and Vault Leak []byte Fields in Audit Logs CVE-2025-62513Mediumgithub.com/openbao/openbao: OpenBao leaks HTTPRawBody in Audit LogsCVE-2025-59043Highgithub.com/openbao/openbao: OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requestsCVE-2025-55001Mediumgithub.com/openbao/openbao: OpenBao LDAP MFA Enforcement Bypass When Using Username As AliasCVE-2025-55003Mediumgithub.com/openbao/openbao: OpenBao Login MFA Bypass of Rate Limiting and TOTP Token ReuseCVE-2025-55000Mediumgithub.com/openbao/openbao: OpenBao TOTP Secrets Engine Code Reuse

Stop the waste.
Protect your environment with Kodem.