CVE-2026-115359
CVE-2026-115359 · OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
CVSS 6.3 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
openbao
- Versiones
- ≥ 0, < 2.6.4: Afectada (semver)
- 2.6.4: No afectada (semver)
- ≥ 2.7.0, < 2.7.1: Afectada (semver)
- 2.7.1: No afectada (semver)
Actualiza a 2.6.4; Actualiza a 2.7.1