OpenBao does not validate that a service account token remains valid when a token issued by the Kubernetes Auth method is renewed. An attacker who can authenticate to OpenBao can repeatedly renew the token, allowing continued access even after the underlying Kubernetes service account has been deleted. The flaw permits attackers to maintain unauthorized administrative or user privileges beyond the intended lifecycle of the service account, potentially leading to data exposure or further privilege escalation within the Cloud provider environment.

OpenBao instances running versions before 2.6.4 or 2.7.0 before 2.7.1 are affected. The issue applies to all builds of the openbao:openbao product referenced in the common CPE string. Upgrading to 2.6.4 or newer and to 2.7.1 or newer resolves the flaw.

The flaw carries a CVSS score of 5.3, indicating moderate severity. The EPSS score is not available, so current public exploit knowledge is limited. It is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation. The attack requires an authenticated session to the token renewal endpoint, so the threat is internal or an attacker who has already compromised a legitimate service account. The attacker can repeatedly request token renewal, only limited by rate controls or client configuration, and maintain a valid token after the original service account is removed.