Vulnerability GHSA-444v-8vxr-p36h
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
5 days ago
September 22, 2026 at 08:36 PM UTC
OpenBao Agent Writes Secrets to Stdout
v0.1.0 - v1.1.5
v0.1.0 - v1.1.5
Summary
OpenBao Agent Writes Secrets to Stdout
Details
Impact
During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in env_template to stdout. This primarily happens when num_retries is met.
This vulnerability is original to Vault and was reported via the OpenBao security mailing list.
Patches
This is addressed in OpenBao v2.6.0 GA.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
5 days ago
OpenBao Skips Stricter Deny Policy for LIST operations
v0.1.0 - v1.1.5 GHSA-xp3c-3jw3-4vcr
v0.1.0 - v1.1.5 GHSA-xp3c-3jw3-4vcr
Critical
5 days ago
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
v0.1.0 - v1.1.5 GHSA-34fc-gh42-pj53
v0.1.0 - v1.1.5 GHSA-34fc-gh42-pj53
High Risk
5 days ago
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
v0.1.0 - v1.1.5 GHSA-59w7-v8rr-pr4p
v0.1.0 - v1.1.5 GHSA-59w7-v8rr-pr4p
Unknown
3 months ago
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL in github.com/openbao/openbao
v0.1.0 - v1.15.5 GO-2026-5657
v0.1.0 - v1.15.5 GO-2026-5657
Unknown
3 months ago
OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao
<0.0.0-20260420173541-6d2e0506e2b4 GO-2026-5674
<0.0.0-20260420173541-6d2e0506e2b4 GO-2026-5674
Impacted packages
Timeline
Published
5 days ago
September 22, 2026 at 08:36 PM UTC
Last Modified
5 days ago
September 22, 2026 at 09:00 PM UTC