Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-39388— OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

Quick assessment

Affected
openbao openbao
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenBao是OpenBao开源的一个敏感数据管理软件。 OpenBao 2.5.3之前版本存在信任管理问题漏洞，该漏洞源于证书身份验证方法在令牌续订时匹配不正确，可能导致攻击者使用同一CA签名的同级证书和密钥续订令牌，从而延长原始令牌持有的动态租约生命周期。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.14% · P3

Possible ATT&CK Techniques 1 AI

T1136.003 · Cloud Account
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-39388

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate
Source: CVE Program / CVE List V5
Vulnerability Description
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
OpenBao 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenBao是OpenBao开源的一个敏感数据管理软件。 OpenBao 2.5.3之前版本存在信任管理问题漏洞，该漏洞源于证书身份验证方法在令牌续订时匹配不正确，可能导致攻击者使用同一CA签名的同级证书和密钥续订令牌，从而延长原始令牌持有的动态租约生命周期。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
openbao openbao < 2.5.3 -

II. Public POCs for CVE-2026-39388

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-39388

请登录查看更多情报信息。

Same Patch Batch · openbao · 2026-04-21 · 4 CVEs total

CVE-2026-39396 3.1 LOW OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)
CVE-2026-39946 OpenBao allows SQL Injection in PostgreSQL database secrets engine
CVE-2026-40264 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

IV. Related Vulnerabilities

Same product: openbao
Same vendor: openbao
Same weakness: CWE-295

V. Comments for CVE-2026-39388

No comments yet

Leave a comment