OpenBao versions from 2.5.0 up to but not including 2.6.2 contain a vulnerability in the PKI role allowed_ip_sans_cidr enforcement. When use_csr_sans is enabled, authenticated users with sign permission can submit a CSR containing IP SANs outside the allowed range and obtain CA-signed certificates for unauthorized IP addresses. This issue is fixed in version 2.6.2.