CyberRota Analysis
AI-GeneratedOpenBao versions prior to 2.6.0 are vulnerable due to a flaw in the exec rendering mode that can expose sensitive secrets to standard output after repeated rendering failures. This could allow a process supervisor, log collector, or local user with access to that output to retrieve the rendered secret values. Organizations using OpenBao for secrets management should prioritize upgrading to version 2.6.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.