PT-2026-42808 · Openbao · Openbao

Published 2026-05-21 · Updated 2026-05-28 · CVE-2026-46358

Positive Technologies (AI Summary)

CVSS v4.0

5.4

Medium

Base vector

AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.4

Description The inline auth functionality incorrectly redacts audit log entries. This causes non-auth headers to be removed while auth-related headers are retained in cleartext. Exploitation requires an attacker to have compromised access to the audit device.

Recommendations Update to version 2.5.4. Review leaked source authentication material and rotate it as appropriate.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-46358

GHSA-Q8CJ-789H-VG24

OPENSUSE-SU-2026:10835-1

Affected Products

Openbao

References · 11

• https://osv.dev/vulnerability/openSUSE-SU-2026:10835-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8cj-789h-vg24 · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://github.com/openbao/openbao/security/advisories/GHSA-q8cj-789h-vg24 · Note
• https://github.com/openbao/openbao/pull/3076 · Note
• https://github.com/openbao/openbao/releases/tag/v2.5.4 · Note
• https://github.com/openbao/openbao/issues/3074 · Note
• https://github.com/openbao/openbao/commit/131c6966af4dfb4e1906703436eecdb8f2a3e9df · Note
• https://suse.com/security/cve/CVE-2026-46405 · Note
• https://suse.com/security/cve/CVE-2026-45808 · Note
• https://suse.com/security/cve/CVE-2026-46358 · Note