OpenBao versions from 2.3.0 up to but not including 2.6.3 contain an incorrect authorization vulnerability in the ACL policy cache. This flaw allows tokens to reference policies from arbitrary namespaces via specially crafted policy names, enabling attackers to gain capabilities across namespace boundaries, including the root namespace.
OpenBao versions prior to 2.6.3 have a missing authorization check on the /agent/v1/quit and /proxy/v1/quit endpoints. This flaw allows attackers to stop Agent and Proxy services by omitting the required X-Vault-Header when the require_request_header setting is enabled. The issue is fixed in version 2.6.3.
OpenBao versions 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 have an information disclosure vulnerability that exposes the tls_acme_eab_mac_key via the sanitized configuration endpoint. This key is used for ACME External Account Binding for TLS listener certificates, and its exposure allows unauthorized binding to the operator's ACME account. The issue is fixed in versions 2.6.4 and 2.7.1.
OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 contain a vulnerability in the AppRole authentication method where expired Secret IDs are not checked upon use. This flaw allows expired Secret IDs to remain valid until they are removed by a periodic tidy process, potentially enabling unauthorized login beyond the intended time-to-live (TTL).
OpenBao versions prior to 2.6.3 contain an access control list (ACL) bypass vulnerability. This flaw causes explicit deny rules based on forbidden identity metadata templates to be silently dropped when wildcard grants are used. As a result, attackers with identity metadata containing wildcard or path segments can gain unauthorized access to paths that should be denied within the wildcard scope. The issue is fixed in version 2.6.3.
OpenBao versions prior to 2.6.3 contain an open redirect vulnerability in the UI's OIDC identity provider. This flaw allows attackers to craft links that redirect unauthenticated users to malicious destinations, potentially facilitating phishing or credential theft attacks. The vulnerability is fixed in version 2.6.3.
OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 have a vulnerability in the rate limit quota subsystem. The flaw causes role resolution to fail for requests with form-encoded bodies or forwarded certificates, allowing quota rules scoped to backend-specific roles to be bypassed. This enables valid callers to repeatedly issue tokens without consuming their configured role-based rate limit budget.
OpenBao versions before 2.6.3 and between 2.7.0 and before 2.7.1 have an information disclosure vulnerability. Attackers can cause sensitive data to be leaked into audit logs by sending malformed plugin parameters, specifically malformed TypeKVPair or TypeHeader field values. This results in error messages containing sensitive input being recorded in audit logs.
OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 have an issue where response audit entries are not recorded for certain unauthenticated endpoints related to root token generation and rekey operations. This lack of response audit logging can hinder forensic detection of these sensitive operations.
OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 contain a vulnerability in the Kubernetes Auth method token renewal process. The software does not verify that the original Kubernetes service account token used for authentication is still valid when renewing tokens. This allows an authenticated attacker to persist access by continuously renewing tokens even after the associated Kubernetes service account has been deleted.
A vulnerability in the Go programming language's crypto/x509 package involves distrust of certain compromised intermediate certificates. While Go typically relies on system root certificates, some environments may not update trust stores automatically. To mitigate this, a denylist was added to reject verification attempts involving these untrustworthy intermediate certificates.
A vulnerability in Grafana Enterprise's SCIM API allows a service account with user-management permissions in one organization to read, modify, disable, or delete users in other organizations on the same instance. This affects only Grafana Enterprise instances with SCIM enabled. The issue is due to insecure direct object reference. Fixed versions are available.
A buffer overflow vulnerability exists in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. Fixed versions are available and users should update to versions 1.0.10, 1.1.1, or 1.2.1 to remediate this issue.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability due to missing authorization checks in the chttpd component. This flaw allows any request to read the full contents of prefixed _users or _replicator databases via an unauthorized API endpoint. The use of such prefixed system databases is uncommon. The issue is fixed in version 3.5.3, and users are advised to upgrade.
Apache CouchDB versions 3.5.2 and earlier contain an unsafe binary deserialization vulnerability in the chttpd component. This flaw allows an authenticated user to cause a denial of service through memory exhaustion by exploiting atom-table exhaustion in _changes sequences and _search bookmarks. The issue is fixed in version 3.5.3.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability in the replicator component where it follows HTTP redirects indefinitely due to a missing circuit-breaker. This flaw allows the owner of a replication source or target to cause a denial of service by creating an infinite HTTP redirect loop. The issue is fixed in version 3.5.3.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability in the chttpd component where an unlimited gzip decompression routine can be triggered by any remote client via a POST request to /_session. This flaw allows denial of service through memory exhaustion. The issue is fixed in version 3.5.3.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability where an unvalidated runtime configuration value allows a CouchDB server administrator to execute arbitrary shell commands as the operating system user running CouchDB. This issue is fixed in version 3.5.3.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability where authenticated users can access replication credentials of other users due to insufficient filtering in the _replicator database. This issue allows credential disclosure to non-owner members. The vulnerability is fixed in version 3.5.3.