CVE-2026-115369 Details
Description
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.
A vulnerability exists in OpenBao versions 2.5.0 prior to 2.6.2, where the Public Key Infrastructure (PKI) role restriction on allowed IP Subject Alternative Names (SANs) is not properly enforced for IP SANs derived from a Certificate Signing Request (CSR). This issue arises when the 'use_csr_sans' feature is enabled, which is the default setting. Authenticated users with signing permissions can exploit this vulnerability by submitting a CSR that includes an out-of-range IP SAN to the 'pki/sign/<role>' endpoint. As a result, they can obtain CA-signed certificates for unauthorized IP addresses, circumventing the intended restrictions.
Users can upgrade to OpenBao version 2.6.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenBao | >= 2.5.0, < 2.6.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |