OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 contain a vulnerability in the Kubernetes Auth method token renewal process. The software does not verify that the original Kubernetes service account token used for authentication is still valid when renewing tokens. This allows an authenticated attacker to persist access by continuously renewing tokens even after the associated Kubernetes service account has been deleted.