PT-2026-33881 · Hashicorp+2 · Hashicorp Vault+2

Published 2026-04-21 · Updated 2026-05-27 · CVE-2026-39388

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.3

Description The Certificate authentication method contains a flaw during token renewal when disable binding=true is configured. The system incorrectly verifies if the mTLS certificate presented during a renewal request matches the original. This allows an attacker with a sibling certificate and key signed by the same Certificate Authority (CA) to renew tokens, even if they do not match the original role or certificate. While the attacker must possess the original token or its accessor, this could allow them to extend the lifetime of dynamic leases. This issue originated from HashiCorp Vault.

Recommendations Update to version 2.5.3. As a temporary workaround, ensure privileged roles are tightly scoped to single certificates.

Fix

Improper Certificate Validation

Incorrect Authorization

Weakness Enumeration

CWE-295

CWE-863

Related Identifiers

CVE-2026-39388

GHSA-7CCV-RP6M-RFFR

OPENSUSE-SU-2026:10594-1

Affected Products

Hashicorp Vault

Openbao

Red Os

References · 19

• https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7ccv-rp6m-rffr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39388 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10594-1 · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://github.com/openbao/openbao/releases/tag/v2.5.3 · Note
• https://github.com/openbao/openbao/commit/9ab7a066826cc544c30e8b203f8f472076f366e1 · Note
• https://github.com/openbao/openbao/pull/2932 · Note
• https://suse.com/security/cve/CVE-2026-3605 · Note
• https://suse.com/security/cve/CVE-2026-39396 · Note
• https://suse.com/security/cve/CVE-2026-39388 · Note
• https://twitter.com/_cvereports/status/2049063857981706501 · Twitter Post
• https://suse.com/security/cve/CVE-2026-5807 · Note
• https://suse.com/security/cve/CVE-2026-40264 · Note
• https://twitter.com/dailycve/status/2046694153845723493 · Twitter Post