Vulnerability GO-2026-5267
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 06:43 PM UTC
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types in github.com/openbao/openbao
<0.0.0-20260617104123-db57c62602b2
<0.0.0-20260617104123-db57c62602b2
Summary
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types in github.com/openbao/openbao
Details
OpenBao: Transit secrets engine crashes on key creation with derived: true for asymmetric key types in github.com/openbao/openbao
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
5 days ago
OpenBao Skips Stricter Deny Policy for LIST operations
v0.1.0 - v1.1.5 GHSA-xp3c-3jw3-4vcr
v0.1.0 - v1.1.5 GHSA-xp3c-3jw3-4vcr
Critical
5 days ago
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
v0.1.0 - v1.1.5 GHSA-34fc-gh42-pj53
v0.1.0 - v1.1.5 GHSA-34fc-gh42-pj53
High Risk
5 days ago
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
v0.1.0 - v1.1.5 GHSA-59w7-v8rr-pr4p
v0.1.0 - v1.1.5 GHSA-59w7-v8rr-pr4p
Low Risk
5 days ago
OpenBao Agent Writes Secrets to Stdout
v0.1.0 - v1.1.5 GHSA-444v-8vxr-p36h
v0.1.0 - v1.1.5 GHSA-444v-8vxr-p36h
Unknown
3 months ago
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL in github.com/openbao/openbao
v0.1.0 - v1.15.5 GO-2026-5657
v0.1.0 - v1.15.5 GO-2026-5657
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 06:43 PM UTC
Last Modified
2 days ago
September 25, 2026 at 02:25 PM UTC