OpenBao before 2.6.4 and early 2.7.x versions fail to write response audit entries for the sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.

The vulnerability affects OpenBao (openbao) versions earlier than 2.6.4 and earlier than 2.7.1 of the 2.7.x series. The affected product is the OpenBao service exposing sys/generate-root, sys/rekey, and sys/rekey-recovery-key APIs.

The CVSS score of 2.1 classifies this as a low‑severity issue. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation activity. The likely attack vector involves unauthenticated access to the vulnerable API endpoints, which allows an attacker to create or rotate root tokens while avoiding logged response events and potentially escaping detection during incident response.