CVE-2026-46358
Published: Fri, 07 Aug 2026 21:17
Summary
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers be
Details
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.
Are YOU affected by CVE-2026-46358?
5-second check on your actual server. Reads /etc/os-release, uname -r, and dpkg-query; matches against the live USN + Debian Security Tracker feeds; tells you whether CVE-2026-46358 (and any other live CVE) applies. Anonymous, no signup.
curl https://mindsparkstack.com/scan.sh | bash
References
- https://github.com/openbao/openbao/commit/131c6966af4dfb4e1906703436eecdb8f2a3e9df
- https://github.com/openbao/openbao/issues/3074
- https://github.com/openbao/openbao/pull/3076
- https://github.com/openbao/openbao/releases/tag/v2.5.4
- https://github.com/openbao/openbao/security/advisories/GHSA-q8cj-789h-vg24
- https://github.com/openbao/openbao/issues/3074
StackPatch runs this match against YOUR installed packages every hour
Free (3 servers) / from $9/mo (14-day free trial) / Solo $9/mo / Pro $29/mo / Team $79/mo. Indie pricing.