OpenBao CVE-2026-115358

Exploitation requires a high-privilege authenticated principal (PR:H) able to send requests to an OpenBao plugin, and the request must carry malformed values in fields of type TypeKVPair or TypeHeader so that OpenBao's error handling echoes the sensitive input. Audit logging must be enabled for the error to be recorded, and the adversary (or an unintended party) must have read access to those audit logs to actually obtain the leaked data. Limiting factors: the high privilege requirement, the passive attack requirement (AT:P) and passive user interaction (UI:P) noted in the vector, impact limited to low confidentiality only, and the need for audit-log visibility - all of which keep real-world risk low. Affected: OpenBao <2.6.3 and the 2.7.0 line before 2.7.1 (SDK).

This is a low-severity, low-priority issue and the signals agree. The vendor CVSS 4.0 base score is 2.0, and the vector (AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N) confirms minimal impact: only low confidentiality, no integrity or availability effect, high privileges required (PR:H), a passive attack requirement (AT:P), and passive user interaction (UI:P). vuln.today assigns a 'monitor' decision label - the lowest urgency tier - consistent with the score. There is no CISA KEV listing and no EPSS score in the provided data, and no exploit/PoC reference is supplied (the VulnCheck and GHSA links are advisories, not exploit code), so there is no indication of active or imminent exploitation. The core mechanism is well understood and vendor-confirmed: malformed TypeKVPair or TypeHeader field values cause error messages containing the submitted sensitive input to be written to audit logs (CWE-532), the same class as the prior GHSA-8f5r-8cmq-7fmq. No signals conflict here; the only caveat is that EPSS is absent, so probabilistic exploitation likelihood cannot be independently weighed, but given PR:H and the information-only, low-confidentiality impact, this is a genuine low-priority housekeeping fix rather than an emergency.

A user who already holds a high-privilege OpenBao token sends a request to a plugin containing malformed TypeKVPair or TypeHeader field values; OpenBao generates an error message that embeds the submitted sensitive input and records it in the audit log. Anyone with read access to those audit logs can then recover the leaked sensitive data. No public exploit code is identified at time of analysis; the mechanism is vendor-described but the data exposed is limited (low confidentiality impact) and the attacker must already be privileged.