CVE-2026-115369: OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
Received
Published 22-10-2026Last modified 22-10-2026
Vulnerability summary
CVE-2026-115369 is a low (CVSS 2.2) Incorrect Authorization vulnerability in openbao.
CVSS score
2.2/10
010
Low · v3.1 (CVE.org)EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 22-10-2026PublishedVulnerability first disclosed.
Description
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.
CVSS metrics
4 scores · 2 sources · 2 versionsLow 2.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low 2.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:NSourcesAll 2 agree
- NVDNIST2.2LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Openbao1 product
- openbao≥ 2.5.0, < 2.6.2
1 vendor · 1 product
References
2 links- www.vulncheck.com/advisories/…Third Party Advisory