Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao: Privileged Operator May Execute Code on the Underlying Host

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

OpenBao lacks user confirmation for OIDC direct callback mode

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

OpenBao's Namespace Deletion May Not Delete Data Properly

OpenBao leaks HTTPRawBody in Audit Logs

OpenBao vulnerable to denial of service via malicious JSON request processing

OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation

Vault Vulnerable to Denial of Service When Processing Raft Join Requests

OpenBao Privileged Operator Identity Group Root Escalation

OpenBao Root Namespace Operator May Elevate Token Privileges

Vault Operators in Root Namespace May Elevate Their Privileges

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao: LDAPi ldaputil (wrong escape func)

OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)

OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

OpenBao TOTP Secrets Engine Enables Code Reuse

Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin

OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

OpenBao Userpass and LDAP User Lockout Bypass

OpenBao allows SQL Injection in PostgreSQL database secrets engine

OpenBao and Vault Leak []byte Fields in Audit Logs

OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data

OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing

OpenBao: Timing Side-Channel in Userpass Auth Method

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao Agent Writes Secrets to Stdout

OpenBao's System Backend allows Unauthorized Management of the containing Namespace

OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs

OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters