OpenBao versions prior to 2.6.3 have a missing authorization check on the /agent/v1/quit and /proxy/v1/quit endpoints. This flaw allows attackers to stop Agent and Proxy services by omitting the required X-Vault-Header when the require_request_header setting is enabled. The issue is fixed in version 2.6.3.
OpenBao versions 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 have an information disclosure vulnerability that exposes the tls_acme_eab_mac_key via the sanitized configuration endpoint. This key is used for ACME External Account Binding for TLS listener certificates, and its exposure allows unauthorized binding to the operator's ACME account. The issue is fixed in versions 2.6.4 and 2.7.1.
OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 contain a vulnerability in the AppRole authentication method where expired Secret IDs are not checked upon use. This flaw allows expired Secret IDs to remain valid until they are removed by a periodic tidy process, potentially enabling unauthorized login beyond the intended time-to-live (TTL).
OpenBao versions prior to 2.6.3 contain an access control list (ACL) bypass vulnerability. This flaw causes explicit deny rules based on forbidden identity metadata templates to be silently dropped when wildcard grants are used. As a result, attackers with identity metadata containing wildcard or path segments can gain unauthorized access to paths that should be denied within the wildcard scope. The issue is fixed in version 2.6.3.
OpenBao versions prior to 2.6.3 contain an open redirect vulnerability in the UI's OIDC identity provider. This flaw allows attackers to craft links that redirect unauthenticated users to malicious destinations, potentially facilitating phishing or credential theft attacks. The vulnerability is fixed in version 2.6.3.
OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 have a vulnerability in the rate limit quota subsystem. The flaw causes role resolution to fail for requests with form-encoded bodies or forwarded certificates, allowing quota rules scoped to backend-specific roles to be bypassed. This enables valid callers to repeatedly issue tokens without consuming their configured role-based rate limit budget.
OpenBao versions before 2.6.3 and between 2.7.0 and before 2.7.1 have an information disclosure vulnerability. Attackers can cause sensitive data to be leaked into audit logs by sending malformed plugin parameters, specifically malformed TypeKVPair or TypeHeader field values. This results in error messages containing sensitive input being recorded in audit logs.
OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 have an issue where response audit entries are not recorded for certain unauthenticated endpoints related to root token generation and rekey operations. This lack of response audit logging can hinder forensic detection of these sensitive operations.
OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 contain a vulnerability in the Kubernetes Auth method token renewal process. The software does not verify that the original Kubernetes service account token used for authentication is still valid when renewing tokens. This allows an authenticated attacker to persist access by continuously renewing tokens even after the associated Kubernetes service account has been deleted.
CVE-2026-114358 is a critical SQL injection vulnerability in the Radius Xenia M2M Platform's password recovery functionality. It arises from insufficient validation of user input in the web management interface, allowing unauthenticated remote attackers to inject crafted SQL queries. Exploitation can lead to unauthorized access to sensitive data, database enumeration, or modification of database records.
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
A buffer overflow vulnerability exists in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. Fixed versions are available and users should update to versions 1.0.10, 1.1.1, or 1.2.1 to remediate this issue.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability due to missing authorization checks in the chttpd component. This flaw allows any request to read the full contents of prefixed _users or _replicator databases via an unauthorized API endpoint. The use of such prefixed system databases is uncommon. The issue is fixed in version 3.5.3, and users are advised to upgrade.
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability in the chttpd component where an unlimited gzip decompression routine can be triggered by any remote client via a POST request to /_session. This flaw allows denial of service through memory exhaustion. The issue is fixed in version 3.5.3.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability where an unvalidated runtime configuration value allows a CouchDB server administrator to execute arbitrary shell commands as the operating system user running CouchDB. This issue is fixed in version 3.5.3.
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.