CVE-2026-115359 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115359?
CVE-2026-115359 is a medium-severity vulnerability in openbao, published on 22 Oct 2026.
Official description
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
Weakness: CWE-799
Which versions are affected by CVE-2026-115359?
1 open source package ship an affected version, including openbao.
| Package | Affected | Fixed in |
|---|---|---|
openbao Bitnami | All versions | 2.6.4, 2.7.1 |
How do I fix CVE-2026-115359?
Upgrade openbao to a fixed version for your release line: 2.6.4 or 2.7.1.
Is CVE-2026-115359 being exploited?
There is no known exploitation of CVE-2026-115359 in the wild and no public exploit code.
Sources
Also known as BIT-openbao-2026-115359, GHSA-4pgx-x639-9642, GHSA-5v22-543h-wg96.