PT-2026-42809 · Openbao · Openbao

Published 2026-05-21 · Updated 2026-05-28 · CVE-2026-46405

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.4

Description In the Kerberos authentication method, the GET handler or the use of an Authorization: Negotiate header causes the response to include a logical.Auth object alongside an error message. This leads to the creation of tokens with only the default policy and default TTL, lacking entity information. These tokens are hidden by the error message and are not accessible to the caller outside of sys/raw. The primary impact is potential increase in storage usage.

Recommendations Update to version 2.5.4. Set a rate limit quota to limit the creation of these paths as a temporary mitigation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-46405

GHSA-7J6W-VVW2-5F9C

OPENSUSE-SU-2026:10835-1

Affected Products

Openbao

References · 10

• https://osv.dev/vulnerability/openSUSE-SU-2026:10835-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7j6w-vvw2-5f9c · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://github.com/openbao/openbao/pull/3150 · Note
• https://github.com/openbao/openbao/security/advisories/GHSA-7j6w-vvw2-5f9c · Note
• https://github.com/openbao/openbao/releases/tag/v2.5.4 · Note
• https://github.com/openbao/openbao/commit/0d82e0a5a3b6a93e8087bcbaf0b11326c12d4f4d · Note
• https://suse.com/security/cve/CVE-2026-46405 · Note
• https://suse.com/security/cve/CVE-2026-45808 · Note
• https://suse.com/security/cve/CVE-2026-46358 · Note