Openbao CVE-2025-4166

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when con

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certifi

Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. Rated high severity

OpenBao versions before 2.3.0 contain an unauthenticated denial-of-service vulnerability in the root rekey and recovery

OpenBao is an open source identity-based secrets management system. Rated high severity (CVSS 7.5), this vulnerability i

Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a den

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certifi

OpenBao 2.5.2 and earlier fails to properly quote PostgreSQL schema names during role revocation in the PostgreSQL datab

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certifi

Disk exhaustion via decompression bomb in OpenBao's OCI plugin downloader allows network attackers to exhaust victim dis

OpenBao versions prior to 2.5.3 allow high-privileged administrators in one tenant to revoke or renew authentication tok