MEDIUMCVSS v3.1 5.4Vulnerability
CVE-2026-115356
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-22T22:14:18.200859+00:00
- Cvss score
- 5.4
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-10-22T22:16:40+00:00
- Score
- 5.4
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-115356
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- First seen by Signal
- 2026-10-22T22:12:23+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Published at
- 2026-10-22T19:17:41.677
- Last modified
- 2026-10-22T19:17:41.677
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph