OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate (CVE-2026-39388)
Description
OpenBao versions prior to 2.5.3 have a vulnerability in the Certificate authentication method that allows token renewal using a different certificate signed by the same CA when disable_binding=true is set. This flaw permits attackers with knowledge of the original token or its accessor to extend the lifetime of dynamic leases by renewing tokens with sibling certificates, even if those certificates do not match the original role or certificate. The issue is fixed in version 2.5.3.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenBao's Certificate authentication method incorrectly matches certificates during token renewal when disable_binding=true is set. This allows an attacker possessing a sibling certificate and key signed by the same CA, along with knowledge of the original token or accessor, to renew tokens beyond their intended lifetime. The vulnerability affects versions prior to 2.5.3 and is a derivative of a similar issue in HashiCorp Vault. The vulnerability is addressed in OpenBao version 2.5.3.
Potential Impact
An attacker with access to a sibling certificate signed by the same CA and knowledge of the original token or its accessor can renew tokens, thereby extending the lifetime of dynamic leases associated with those tokens. This could allow continued access within the scope of the original token, potentially increasing the window for unauthorized access or actions.
Mitigation Recommendations
A fix is available in OpenBao version 2.5.3. Users should upgrade to this version to remediate the vulnerability. As a workaround, privileged roles should be tightly scoped to single certificates to limit the impact of this issue until the upgrade can be applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-openbao-2026-39388
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-39388"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Low
Threat ID: 6aa005f4acd9273b49ab6393
Added to database: 09/08/2026, 12:56:20 UTC
Last enriched: 09/08/2026, 13:31:36 UTC
Last updated: 10/23/2026, 15:10:12 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.