OpenBao 2.2.0 through 2.6.3 and 2.7.0 expose the tls_acme_eab_mac_key via the sys/config/state/sanitized endpoint. This information disclosure allows an attacker who can access the endpoint to obtain the MAC key used for ACME External Account Binding, potentially enabling them to bind to the operator's ACME account and issue TLS certificates. The vulnerability is classified as an information exposure (CWE‑212).

Affected versions include OpenBao OpenBao releases 2.2.0 through 2.6.3 (all releases prior to 2.6.4) and 2.7.0 through 2.7.0 (all releases prior to 2.7.1). The vendor is OpenBao and the product is OpenBao, and any deployments of the affected releases are vulnerable.

The CVSS base score is 2.1, indicating a low severity informational disclosure. Exploitation requires access to the sanitized configuration endpoint, and based on the description, it is inferred that this endpoint is typically protected by authentication or internal network restrictions. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is considered low. Nevertheless, the disclosed MAC key can be used to bind to an ACME account and create TLS certificates, so the exposure can lead to downstream trust issues.