CVE-2026-115359 in OpenBao
Summary
by MITRE • 10/22/2026
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in OpenBao versions prior to 2.6.4 and 2.7.x before 2.7.1 represents a critical failure in the access control enforcement mechanisms, specifically within the rate limiting subsystem responsible for managing quota allocations based on backend-specific roles. This flaw stems from an inconsistency in how the system processes incoming authentication requests depending on their content type or transmission method. When clients submit requests using form-encoded bodies or utilize forwarded certificates for identity verification, the underlying role resolution logic fails to correctly map these requests to their designated security profiles. Consequently, the quota rules that are strictly scoped to specific backend roles remain unenforced during these interaction modes, creating a significant gap in the system's defensive posture against resource exhaustion and unauthorized access scaling.
From a technical perspective, this defect allows valid callers who possess legitimate credentials or certificates to bypass rate limit constraints entirely. In normal operation, OpenBao restricts the number of tokens that can be issued within a specific time window based on the role assigned to the caller, thereby preventing abuse such as brute-force attacks or denial-of-service conditions through token flooding. However, due to the resolution failure in form-encoded and forwarded certificate scenarios, these callers can repeatedly issue new access tokens without consuming any portion of their configured rate limit budget. This effectively neutralizes a primary mitigation strategy designed to protect backend services from being overwhelmed by excessive authentication attempts or token generation requests, allowing an attacker with valid but limited credentials to escalate their impact significantly beyond intended limits.
The operational impact of this vulnerability is severe, particularly in environments where OpenBao serves as the central identity provider for critical infrastructure. An adversary exploiting this flaw could perform a denial-of-service attack by generating a massive volume of tokens, potentially exhausting system resources such as memory and database connections associated with token storage and validation. Furthermore, if rate limits are tied to security policies that restrict privilege escalation or sensitive data access based on request frequency, bypassing these controls allows for unchecked enumeration of secrets or unauthorized expansion of the attacker's footprint within the vaulted environment. This undermines the principle of least privilege by allowing a user to exceed their allocated operational boundaries without triggering alerts or throttling mechanisms designed to detect anomalous behavior patterns.
This vulnerability aligns with CWE-787, which describes out-of-bounds write scenarios where improper validation leads to unexpected state changes, and more specifically relates to CWE-693 regarding the use of a protected resource in an unauthorized context due to flawed access control logic. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK T1078, Valid Accounts, by allowing attackers to leverage existing credentials for sustained abuse without detection through rate-limiting anomalies. It also touches upon T1496, Resource Hijacking, as the attacker can consume computational resources beyond their authorized quota limits.
To mitigate this risk, organizations running OpenBao must immediately upgrade to version 2.6.4 or later if operating on the 2.7.x branch, ensuring that at least patch level 2.7.1 is applied for those specific releases. These updates contain corrections to the role resolution logic, ensuring consistent enforcement of quota rules regardless of whether requests are transmitted via form-encoded bodies or forwarded certificates. Until upgrades can be performed, administrators should implement network-level rate limiting using reverse proxies such as Nginx or HAProxy in front of OpenBao instances to enforce stricter request throttling policies that do not rely solely on the application's internal role-based quota system. Additionally, monitoring logs for unusual spikes in token issuance from single identities can help detect exploitation attempts while mitigation strategies are being deployed.