CVE-2026-115358 OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115358?
CVE-2026-115358 is a low-severity vulnerability in openbao, published on 22 Oct 2026.
Official description
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.
Weakness: CWE-532
Which versions are affected by CVE-2026-115358?
1 open source package ship an affected version, including openbao.
| Package | Affected | Fixed in |
|---|---|---|
openbao Bitnami | All versions | 2.6.3, 2.7.1 |
How do I fix CVE-2026-115358?
Upgrade openbao to a fixed version for your release line: 2.6.3 or 2.7.1.
Is CVE-2026-115358 being exploited?
There is no known exploitation of CVE-2026-115358 in the wild and no public exploit code.
Sources
Also known as BIT-openbao-2026-115358, GHSA-8xxq-mq9m-xmhw, GHSA-h7rj-f8m2-hv6h.