CVE-2026-77285
Received Received - Intake

OpenBao Agent Exec Mode Secret Leakage

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-77285
EUVD
EUVD-2026-85518

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openbao openbao to 2.6.0 (inc)
openbao openbao 2.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenBao Agent versions before 2.6.0. When the Agent encounters repeated rendering failures, such as hitting the maximum retry limit, it reloads the templating system along with the executed application. This process can cause partial secrets from env_template to be written to standard output, potentially exposing sensitive data to processes like log collectors or local users with read access.

Detection Guidance

To detect this vulnerability, monitor OpenBao Agent logs for repeated rendering failures or stdout output during exec mode operations. Check for partial secret exposure in logs or process output when num_retries is reached. Ensure OpenBao Agent is updated to version 2.6.0 or later.

Impact Analysis

If you use OpenBao Agent versions prior to 2.6.0, an attacker with local access and high privileges could exploit this to read secrets written to stdout. This could lead to unauthorized access to sensitive information like passwords or API keys, depending on how the Agent is configured.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations using vulnerable versions must upgrade to mitigate risks of non-compliance and potential data breaches.

Mitigation Strategies
  • Upgrade OpenBao Agent to version 2.6.0 or later to apply the security fix.
  • Review and restrict access to OpenBao Agent logs and stdout output to prevent unauthorized secret exposure.
  • Monitor for repeated rendering failures in the Agent's exec mode, as these may indicate potential secret leakage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart