CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

Low 2.4 Published 23 Sep 2026 Updated 23 Sep 2026

OpenBao Agent may leak secrets to stdout during rendering failures, allowing local users or log collectors to read sensitive data.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-77285?

CVE-2026-77285 is a low-severity vulnerability in openbao, published on 23 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

Weakness: CWE-532

Which versions are affected by CVE-2026-77285?

6 open source packages ship an affected version, including github.com/openbao/openbao and openbao.

Package	Affected	Fixed in
`github.com/openbao/openbao` Go	All versions	`0.0.0-20260714163218-90272575e5f5`
`github.com/openbao/openbao` Go	All versions	`0.0.0-20260714163218-90272575e5f5`
`github.com/openbao/openbao` Go	All versions	`0.0.0-20260714163218-90272575e5f5`
`github.com/openbao/openbao` Go	From `0.1.0` to `1.1.5`	None
`github.com/openbao/openbao` Go	From `0.1.0` to `1.1.5`	None
`openbao` Bitnami	All versions	`2.6.0`

How do I fix CVE-2026-77285?

Upgrade github.com/openbao/openbao to 0.0.0-20260714163218-90272575e5f5 or later.

Is CVE-2026-77285 being exploited?

There is no known exploitation of CVE-2026-77285 in the wild and no public exploit code.

Sources

Also known as BIT-openbao-2026-77285, GHSA-444v-8vxr-p36h, GO-2026-6554, MINI-2cc6-xjcm-hmqr, MINI-w3w8-2xch-cv4m.