CVE-2026-115369 in OpenBao
Summary
by MITRE • 10/23/2026
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in OpenBao versions prior to 2.6.2 represents a critical access control failure within the Public Key Infrastructure (PKI) secrets engine, specifically affecting the certificate signing workflow when Certificate Signing Requests are processed with specific configuration flags enabled. This flaw allows authenticated users possessing sign permissions on PKI roles to bypass intended network segmentation and identity restrictions by injecting unauthorized IP addresses into Subject Alternative Names via CSR parameters. The core technical deficiency lies in the server-side validation logic which fails to cross-reference the IP addresses extracted from a submitted Certificate Signing Request against the allowed_ip_sans_cidr restriction defined for that specific role when the use_csr_sans configuration option is active. Instead of rejecting or sanitizing out-of-range IPs, the system proceeds to generate and issue CA-signed certificates containing these unauthorized identifiers, effectively granting the attacker a valid cryptographic identity associated with network addresses they are not permitted to claim.
From an operational perspective, this vulnerability undermines the fundamental trust model established by PKI systems where certificate issuance is strictly governed by role-based policies designed to limit the scope of issued credentials. An authenticated adversary can exploit this flaw to obtain certificates for IP ranges that may belong to critical infrastructure components, internal management networks, or other sensitive services outside their authorized perimeter. This capability facilitates several severe attack vectors including man-in-the-middle attacks against protected services if the attacker controls a device on an unauthorized subnet and presents a validly signed certificate, lateral movement within a network by impersonating trusted hosts during authentication processes that rely on client certificates, and potential evasion of security monitoring tools that whitelist traffic based on IP addresses present in valid CA-signed certificates. The impact is particularly acute because the resulting certificates are cryptographically valid and recognized as trustworthy by any system trusting the issuing Certificate Authority, making detection through standard certificate validation mechanisms difficult without deep inspection of policy compliance during issuance.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure to enforce restrictions on resource access based on defined policies. It also maps closely to MITRE ATT&CK technique T1557 Adversary-in-the-Middle as it enables the creation of fraudulent credentials for interception purposes, and potentially T1098 Account Manipulation if used to establish persistent unauthorized identities within an identity federation or mutual TLS environment. The root cause is a logic error in the application layer where input validation from external sources such as CSRs is not adequately sanitized against internal security policies before processing. To mitigate this risk, organizations running OpenBao versions between 2.5.0 and 2.6.1 must upgrade to version 2.6.2 or later immediately upon availability. In the interim, administrators should review PKI role configurations to ensure that use_csr_sans is disabled if strict IP SAN enforcement is required, although this may impact legitimate workflows relying on CSR-provided subject details. Additionally implementing rigorous audit logging and monitoring for certificate issuance events involving unusual IP ranges can help detect exploitation attempts while patches are being deployed.