~ / search / GHSA-444v-8vxr-p36h

GHSA-444v-8vxr-p36h

OpenBao Agent Writes Secrets to Stdout

Source: GitHub Advisory Database (reviewed) Low CVE-2026-77285

Packages

EcosystemPackageAffectedFixed in
Go github.com/openbao/openbao < 0.0.0-20260714163218-90272575e5f5 0.0.0-20260714163218-90272575e5f5
Go github.com/openbao/openbao >= 0.1.0, <= 1.1.5 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in `env_template` to stdout. This primarily happens when `num_retries` is met. This vulnerability is original to Vault and was reported via the OpenBao security mailing list. ### Patches This is addressed in OpenBao v2.6.0 GA.

References

External links from the advisory. They lead to third-party sites.