CVE-2026-115357 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115357?
CVE-2026-115357 is a low-severity vulnerability in openbao, published on 22 Oct 2026.
Official description
OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.
Weakness: CWE-778
Which versions are affected by CVE-2026-115357?
1 open source package ship an affected version, including openbao.
| Package | Affected | Fixed in |
|---|---|---|
openbao Bitnami | All versions | 2.6.4, 2.7.1 |
How do I fix CVE-2026-115357?
Upgrade openbao to a fixed version for your release line: 2.6.4 or 2.7.1.
Is CVE-2026-115357 being exploited?
There is no known exploitation of CVE-2026-115357 in the wild and no public exploit code.
Sources
Also known as BIT-openbao-2026-115357, GHSA-q74w-hv5x-6hxf, GHSA-wcpv-xrx9-27pw.