OpenBao before 2.6.4 and 2.7.0 before 2.7.1 contains a flaw in its rate‑limit quota subsystem where role resolution fails for requests that carry form‑encoded bodies or forwarded certificates, so quota rules scoped to backend‑specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role‑based rate‑limit budget. This can lead to abuse of the token issuance service and exhaustion of backend resources.

OpenBao versions 2.6.1 through 2.6.3 and 2.7.0 through 2.7.0 are affected. The vulnerability targets the openbao openbao product.

The CVSS score is 6.3, indicating a moderate impact. The EPSS score is <1%, suggesting that exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers who possess valid credentials or legitimate call rights can trigger the bypass by sending HTTP requests that contain form‑encoded bodies or use forwarded certificates to a privileged token endpoint. Because the flaw is in role resolution, the risk is primarily in service abuse rather than direct code execution.