LOWCVSS v3.1 2.2Vulnerability
CVE-2026-115362
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.
Properties
- Severity
- LOW
- Nvd fetched at
- 2026-10-22T22:14:18.200859+00:00
- Cvss severity
- LOW
- Cvss score
- 2.2
- Retrieved at
- 2026-10-22T22:16:40+00:00
- Score
- 2.2
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-115362
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
- First seen by Signal
- 2026-10-22T22:12:23+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
- Published at
- 2026-10-22T19:17:42.520
- Last modified
- 2026-10-22T19:17:42.520
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph