CVE-2026-115369
CVE-2026-115369 · OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.
CVSS 2.1 · Low · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
openbao
- Versions
- ≥ 2.5.0, < 2.6.2: Affected (semver)
- 2.6.2: Not affected (semver)
Update to 2.6.2