CVE-2026-77285
Low
Description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.
SeverityLow
CVSS2.4
Exploit probability—
ProductGithub.com/openbao/openbao
PublishedSep 23, 2026
First seenSep 23, 2026
Weakness typeCWE-532CWE-532
How to fix
Update
- github.com/openbao/openbao0.0.0-20260714163218-90272575e5f5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/openbao/openbaoGo | v < 0.0.0-20260714163218-90272575e5f5, 0.1.0 ≤ v ≤ 1.1.5, 0.1.0 ≤ v | 0.0.0-20260714163218-90272575e5f5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.