CVE-2026-77285 Details
Description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.
A vulnerability exists in OpenBao Agent versions prior to 2.6.0, where the exec rendering mode can inadvertently write secrets from the env_template to standard output. This issue arises after the maximum number of rendering retries is reached, prompting the template runner to reload and potentially expose partial secret values. Such output could be accessed by a process supervisor, log collector, or local user with the appropriate permissions.
Users can upgrade to OpenBao version 2.6.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openbao/openbao/commit/90272575e5f58b3883fbb0ccb2238e9285722d1a | [email protected] | Source CodeVendor |
| https://github.com/openbao/openbao/commit/ee3aa4aff72c5176cf02af21eac7158899080878 | [email protected] | Source CodeVendor |
| https://github.com/openbao/openbao/pull/3494 | [email protected] | Issue TrackingVendor |
| https://github.com/openbao/openbao/pull/3495 | [email protected] | Issue TrackingVendor |
| https://github.com/openbao/openbao/releases/tag/v2.6.0 | [email protected] | AdvisoryRelease NotesVendor |
| https://github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenBao | < 2.6.0 (semver) |
CPE
Remediation
| |
| OpenBao Agent | < 2.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |