CVE Explorer

CVE-2026-39388

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:504ed8f6e0c5e665bc9fed5576445ee2b8b13d92708af1ffe1efcc9a0b82c5e8

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"openbao","vendor":"openbao","versions":[{"status":"affected","version":"< 2.5.3"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9168b2c5ae1a6977426513d9efe6b5204259af217162baf6308aca4c5410456 · sha256:6948214b6a80f546… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":2,"baseSeverity":"LOW","privilegesRequired":"HIGH","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:b9168b2c5ae1a6977426513d9efe6b5204259af217162baf6308aca4c5410456 · sha256:6948214b6a80f546… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-295","description":"CWE-295: Improper Certificate Validation","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:b9168b2c5ae1a6977426513d9efe6b5204259af217162baf6308aca4c5410456 · sha256:6948214b6a80f546… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr","tags":["x_refsource_CONFIRM"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b9168b2c5ae1a6977426513d9efe6b5204259af217162baf6308aca4c5410456 · sha256:6948214b6a80f546… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer