CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the response is includes a `logical.Auth` object in addition to an error message. This results in tokens being created with only the default policy, default TTL, and no entity information, which are hidden by the returned error message. No access to these tokens by the caller occurs and the authentication token is not ever made accessible outside of `sys/raw`. This is fixed in OpenBao v2.5.4. As a workaround, users may set a rate limit quota to limit the creation of these paths. As the path is unauthenticated, it isn't possible to deny access to it.

• CWE-770

• https://github.com/openbao/openbao/commit/0d82e0a5a3b6a93e8087bcbaf0b11326c12d4f4d
• https://github.com/openbao/openbao/pull/3150
• https://github.com/openbao/openbao/releases/tag/v2.5.4
• https://github.com/openbao/openbao/security/advisories/GHSA-7j6w-vvw2-5f9c

Published

Aug 7, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4640Vitals ESP developed by Galaxy Software Services has a Missi…8.7
• CVE-2026-46400HAX CMS helps manage microsite universe with PHP or NodeJs b…8.7
• CVE-2026-46401HAX CMS helps manage microsite universe with PHP or NodeJs b…5.3
• CVE-2026-46402Microsoft UFO open-source framework for intelligent automati…8.1
• CVE-2026-46403Klever-Go is the Go implementation of the Klever blockchain …6.3
• CVE-2026-46404BigBlueButton is an open-source virtual classroom. Prior to …6.8
• CVE-2026-46406Claude Code is an agentic coding tool. From 2.1.59 until 2.…6.1
• CVE-2026-46407Vvveb is a powerful and easy to use CMS with page builder to…8.1
• CVE-2026-46408Vvveb is a powerful and easy to use CMS with page builder to…7.6
• CVE-2026-46409OpenYak is a local-first agent runtime for reliable tool-usi…9.6
• CVE-2026-46410FileBrowser Quantum is a free, self-hosted, web-based file m…8.7
• CVE-2026-46411FlashMQ is a MQTT broker/server, designed for multi-CPU envi…6.5