OpenBao versions 2.5.0 through 2.6.1 do not enforce the allowed_ip_sans_cidr restriction on IP Subject Alternative Names (SANs) when the use_csr_sans feature is enabled. As a result, any authenticated caller with sign permission can submit a Certificate Signing Request containing an IP SAN that lies outside the authorized CIDR block and receive a CA‑signed certificate for that IP. This flaw allows the creation of certificates for IP addresses that should not be trusted by the system, potentially enabling man‑in‑the‑middle attacks, spoofing, or other misuse of TLS infrastructure.

The affected product is OpenBao, specifically all releases from 2.5.0 up to and including 2.6.1. These versions expose the vulnerability when the use_csr_sans configuration option is enabled. Any instance running those versions and using the pki/sign/<role> endpoint is susceptible.

The CVSS score of 2.1 indicates a low severity impact, and there is no EPSS data or KEV listing, suggesting the vulnerability has not yet been actively exploited. The attack requires valid authentication and the sign permission, limiting the potential attack surface to privileged users. A remote attacker who can gain sign authorization could use this weakness to generate certificates for unauthorized IPs, thereby compromising the integrity of the PKI infrastructure. Overall, the risk is moderate for privileged accounts but low for general clients.