medium5.4
CVE-2026-115356
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token origina…
Impact
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.
Affected products
| Product | Affected versions |
|---|---|
| OpenBao | before 2.6.4 |
| 2.7.X | before 2.7.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.