CVE-2026-115363 OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115363?
CVE-2026-115363 is a low-severity vulnerability in openbao, published on 22 Oct 2026.
Official description
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.
Weakness: CWE-212
Which versions are affected by CVE-2026-115363?
1 open source package ship an affected version, including openbao.
| Package | Affected | Fixed in |
|---|---|---|
openbao Bitnami | From 2.2.0 | 2.6.4, 2.7.1 |
How do I fix CVE-2026-115363?
Upgrade openbao to a fixed version for your release line: 2.6.4 or 2.7.1.
Is CVE-2026-115363 being exploited?
There is no known exploitation of CVE-2026-115363 in the wild and no public exploit code.
Sources
Also known as BIT-openbao-2026-115363, GHSA-3237-j65r-m5rp, GHSA-983h-5ch6-2726.