Critical RCE Alert: Full takeover of HashiCorp Vault and OpenBao. OpenBao is patched. Vault remains exposed
Source Reddit NetSec
Rated by Threat Radar
Data as of 29 Sep 2026, 22:06 UTC
What to do
AI-suggested
OpenBao users should upgrade immediately to versions 2.6.3 or 2.7.0 where the vulnerability is fully patched. HashiCorp Vault users currently lack an official fix or mitigation due to the absence of coordinated disclosure by IBM. Users should monitor vendor advisories closely and apply any future patches promptly. Patch status for Vault is not yet confirmed; check the vendor advisory for updates.
Discussion
A critical remote code execution (RCE) vulnerability chain has been demonstrated affecting OpenBao and HashiCorp Vault. OpenBao has released patches in versions 2.6.3 and 2.7.0 to fully mitigate the issue. However, HashiCorp Vault remains exposed due to a lack of coordinated disclosure and official mitigation. The exploit requires only unauthenticated access and a specific Raft snapshot policy to achieve full server compromise. This is the second RCE ever found in Vault's codebase and is considered highly plausible in real-world environments.
r/netsec (opens in a new tab)u/the_hypotenuse0 points0 comments
OpenBao engineers at ControlPlane have chained 4 vulnerabilities to show how under certain conditions, an OpenBao or Vault server can be completely compromised from an unauthenticated position. This is only the second RCE ever found in the Vault codebase.
The exploit is highly plausible in real-world environments, requiring only an unauthenticated entry path and a defined Raft snapshot policy to trigger a complete server compromise.
If you are impacted, upgrade as soon as possible to OpenBao 2.6.3 or 2.7.0
While OpenBao is fully patched, HashiCorp Vault remains exposed as of writing. Unfortunately, IBM's unwillingness to coordinate a mutual disclosure policy means Vault users currently lack an official mitigation