Description
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
Published: 2026-10-22
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Rate limit quota bypass enabling repeated token issuance
Action: Apply Patch
AI Analysis

Impact

OpenBao before 2.6.4 and before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget. This can lead to abuse of the token issuance service and exhaustion of backend resources.

Affected Systems

All installations of OpenBao version 2.6.1 through 2.6.3 and 2.7.0 through 2.7.0 are affected. The vulnerability targets the product openbao:openbao.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The exploit path involves sending HTTP requests that contain form-encoded bodies or use forwarded certificates to a privileged token endpoint. Attackers who possess valid credentials or legitimate call rights can trigger the bypass. Due to the nature of the flaw, the risk is primarily in the potential for service abuse rather than direct code execution.

Generated by OpenCVE AI on October 23, 2026 at 03:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest OpenBao release (≥ 2.6.4 or 2.7.1) that contains the rate‑limit quota patch.
  • If an upgrade is not immediately possible, implement API‑rate limiting or token‑issuance quotas at an external gateway or firewall to cap the number of tokens that a client can request, thereby neutralizing the bypass.
  • Continuously monitor token issuance metrics and trigger alerts when a client exceeds reasonable thresholds, so that suspicious activity can be investigated and blocked.

Generated by OpenCVE AI on October 23, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
Title OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
First Time appeared Openbao
Openbao openbao
Weaknesses CWE-799
CPEs cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*
Vendors & Products Openbao
Openbao openbao
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Openbao Openbao
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T19:13:34.716Z

Reserved: 2026-10-22T11:21:20.778Z

Link: CVE-2026-115359

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T19:17:42.093

Modified: 2026-10-22T19:17:42.093

Link: CVE-2026-115359

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T06:15:12Z

Weaknesses
  • CWE-799

    Improper Control of Interaction Frequency