CVE-2026-46358 (GCVE-0-2026-46358)
Vulnerability from cvelistv5
Published
2026-08-07 20:32
Modified
2026-08-11 01:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Summary
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46358",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T01:14:07.881552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T01:14:49.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openbao/openbao/issues/3074"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openbao",
"vendor": "openbao",
"versions": [
{
"status": "affected",
"version": "\u003c 2.5.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao\u0027s inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T21:13:47.124Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openbao/openbao/security/advisories/GHSA-q8cj-789h-vg24",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openbao/openbao/security/advisories/GHSA-q8cj-789h-vg24"
},
{
"name": "https://github.com/openbao/openbao/issues/3074",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbao/openbao/issues/3074"
},
{
"name": "https://github.com/openbao/openbao/pull/3076",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbao/openbao/pull/3076"
},
{
"name": "https://github.com/openbao/openbao/commit/131c6966af4dfb4e1906703436eecdb8f2a3e9df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbao/openbao/commit/131c6966af4dfb4e1906703436eecdb8f2a3e9df"
},
{
"name": "https://github.com/openbao/openbao/releases/tag/v2.5.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbao/openbao/releases/tag/v2.5.4"
}
],
"source": {
"advisory": "GHSA-q8cj-789h-vg24",
"discovery": "UNKNOWN"
},
"title": "OpenBao\u0027s Inline Auth Incorrectly Redacted Headers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46358",
"datePublished": "2026-08-07T20:32:36.832Z",
"dateReserved": "2026-05-13T18:37:30.991Z",
"dateUpdated": "2026-08-11T01:14:49.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-46358\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-11T01:14:07.881552Z\"}}}], \"references\": [{\"url\": \"https://github.com/openbao/openbao/issues/3074\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-11T01:14:44.771Z\"}}], \"cna\": {\"title\": \"OpenBao\u0027s Inline Auth Incorrectly Redacted Headers\", \"source\": {\"advisory\": \"GHSA-q8cj-789h-vg24\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"openbao\", \"product\": \"openbao\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.5.4\"}]}], \"references\": [{\"url\": \"https://github.com/openbao/openbao/security/advisories/GHSA-q8cj-789h-vg24\", \"name\": \"https://github.com/openbao/openbao/security/advisories/GHSA-q8cj-789h-vg24\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/openbao/openbao/issues/3074\", \"name\": \"https://github.com/openbao/openbao/issues/3074\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openbao/openbao/pull/3076\", \"name\": \"https://github.com/openbao/openbao/pull/3076\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openbao/openbao/commit/131c6966af4dfb4e1906703436eecdb8f2a3e9df\", \"name\": \"https://github.com/openbao/openbao/commit/131c6966af4dfb4e1906703436eecdb8f2a3e9df\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openbao/openbao/releases/tag/v2.5.4\", \"name\": \"https://github.com/openbao/openbao/releases/tag/v2.5.4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao\u0027s inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-532\", \"description\": \"CWE-532: Insertion of Sensitive Information into Log File\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-07T21:13:47.124Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-46358\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-11T01:14:49.117Z\", \"dateReserved\": \"2026-05-13T18:37:30.991Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-07T20:32:36.832Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…