~ / search / GHSA-q8cj-789h-vg24

GHSA-q8cj-789h-vg24

OpenBao's Inline Auth Incorrectly Redacted Headers

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-46358

Packages

EcosystemPackageAffectedFixed in
Go github.com/openbao/openbao < 2.5.4 2.5.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. ### Patches This is fixed in OpenBao v2.5.4. ### Resources https://github.com/openbao/openbao/issues/3074

References

External links from the advisory. They lead to third-party sites.