CVE-2026-46358 in OpenBao
Summary
by MITRE • 08/07/2026
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
OpenBao represents a critical component in modern security infrastructure as an open source identity-based secrets management system that handles sensitive authentication and authorization data. The vulnerability under discussion affects the audit logging mechanism within OpenBao's inline authentication functionality, specifically targeting how sensitive information is processed during log generation. This flaw exists in versions prior to 2.5.4 and demonstrates a fundamental weakness in information sanitization practices that directly impacts security monitoring capabilities.
The technical implementation flaw manifests in the improper handling of audit log redaction processes where the system fails to correctly sanitize log entries containing authentication data. Specifically, non-authentication headers are being removed from audit logs while authentication-related headers remain unredacted and visible in cleartext format. This selective redaction creates a dangerous situation where attackers who gain access to audit logging systems can extract sensitive authentication material that should have been protected. The vulnerability aligns with CWE-532, which addresses information exposure through log files, and represents a classic example of improper output sanitization in security-critical components.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable credential theft and unauthorized access escalation. When attackers compromise access to audit devices, they can leverage this flaw to extract authentication tokens, session identifiers, and other sensitive credentials that should remain protected within the logging infrastructure. This creates a pathway for attackers to maintain persistent access or escalate privileges within systems that rely on OpenBao for secrets management. The vulnerability specifically relates to ATT&CK technique T1070.002 which focuses on indicator removal on host through log manipulation and information sanitization.
Security operators must immediately conduct comprehensive reviews of all source authentication material that may have been exposed through this vulnerability, particularly focusing on session tokens, API keys, and credential identifiers that could have been logged in cleartext. The recommended mitigation strategy involves implementing immediate credential rotation for all affected systems and ensuring proper audit log configuration that prevents such selective redaction behavior. Organizations should also verify that their audit logging infrastructure has appropriate access controls and monitoring in place to prevent unauthorized access to sensitive log data, while the fix in OpenBao v2.5.4 addresses the core redaction logic to ensure consistent sanitization of all log entries regardless of header type, thereby preventing future occurrences of this information exposure vulnerability.