CVE-2026-46405

Received Received - Intake

Authentication Token Exposure in OpenBao Kerberos Auth

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the response is includes a `logical.Auth` object in addition to an error message. This results in tokens being created with only the default policy, default TTL, and no entity information, which are hidden by the returned error message. No access to these tokens by the caller occurs and the authentication token is not ever made accessible outside of `sys/raw`. This is fixed in OpenBao v2.5.4. As a workaround, users may set a rate limit quota to limit the creation of these paths. As the path is unauthenticated, it isn't possible to deny access to it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-46405

Affected Vendors & Products

Vendor	Product	Version / Range
openbao	openbao	to 2.5.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

OpenBao before version 2.5.4 has a flaw in its Kerberos authentication method. When a GET request is made or an Authorization: Negotiate header is provided, the system creates tokens with default settings and no entity details. These tokens are hidden by an error message, preventing proper authentication and access control.

Detection Guidance

Detection involves checking OpenBao versions and monitoring for unusual token creation patterns. Verify if your OpenBao version is below 2.5.4. Check logs for failed authentication attempts with Kerberos or Negotiate headers that still generate tokens.

Impact Analysis

This vulnerability could allow unauthorized token creation with minimal privileges. Attackers might exploit it to generate tokens that bypass normal access controls, potentially leading to unauthorized access to secrets or sensitive operations within OpenBao.

Compliance Impact

The vulnerability does not directly impact compliance with GDPR or HIPAA based on the provided context. It involves unauthenticated token creation with default policies but does not expose sensitive data or violate access controls in a way that would breach these standards.

Mitigation Strategies

Upgrade OpenBao to version 2.5.4 or later to address the vulnerability.
Implement a rate limit quota on the affected paths to reduce token creation attempts.
Monitor sys/raw for unauthorized token creation and review logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-46405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70