CVE-2026-115356 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115356?
CVE-2026-115356 is a medium-severity vulnerability in openbao, published on 22 Oct 2026.
Official description
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.
Weakness: CWE-613
Which versions are affected by CVE-2026-115356?
1 open source package ship an affected version, including openbao.
| Package | Affected | Fixed in |
|---|---|---|
openbao Bitnami | All versions | 2.6.4, 2.7.1 |
How do I fix CVE-2026-115356?
Upgrade openbao to a fixed version for your release line: 2.6.4 or 2.7.1.
Is CVE-2026-115356 being exploited?
There is no known exploitation of CVE-2026-115356 in the wild and no public exploit code.
Sources
Also known as BIT-openbao-2026-115356, GHSA-gf3j-hm38-jhh5, GHSA-qmv6-f44g-mj35.