CVE-2026-115363: OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

Received

Published 22-10-2026Last modified 22-10-2026

Vulnerability summary

CVE-2026-115363 is a low (CVSS 3.3) vulnerability in openbao.

Overall risk

13/100

0100

Low · default modelHow is this calculated?

CVSS score

3.3/10

010

Low · v3.1 (CVE.org)

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

22-10-2026
PublishedVulnerability first disclosed.

Description

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.

CVSS metrics

4 scores · 2 sources · 2 versions

v4.02.1v3.13.3

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Affected systems

Openbao1 product

openbao≥ 2.2.0, < 2.6.4 | ≥ 2.7.0, < 2.7.1

1 vendor · 1 product

References

2 links

github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rpVendor Advisory
www.vulncheck.com/advisories/…Third Party Advisory