Medium severity5.4NVD Advisory· Published Oct 22, 2026

CVE-2026-115356

Description

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.

Affected products

Openbao/Openbaollm-fuzzy
Range: <2.6.4, <2.7.1

Patches

Vulnerability mechanics

References

github.com/openbao/openbao/security/advisories/GHSA-gf3j-hm38-jhh5nvd
www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-kubernetes-auth-method-token-renewal-after-revocationnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000