OpenBao Agent CVE-2026-77285

Exploitation requires all of: the OpenBao Agent running in exec rendering mode; secrets supplied through the env_template configuration; an error condition being reached (primarily num_retries being exhausted) that triggers the errant write to stdout; and an adversary having read access to that stdout/log stream. It is not an attacker-initiated remote exploit - the leak is produced by the Agent's own failure handling, so the limiting factors are the non-default exec+env_template deployment mode, the need for a retry-exhaustion/error event, and pre-existing access to the Agent's output or aggregated logs. Affected versions are prior to OpenBao v2.6.0.

This is a genuine but low-priority information-disclosure issue. The vendor assigned no CVSS (N/A), and there is no EPSS score, no CISA KEV listing, no SSVC decision data, and no public exploit code. CWE-532 (insertion of sensitive information into log/output) combined with the description makes clear this is an accidental leak triggered by the OpenBao Agent's own error handling - NOT an attacker-initiated exploit primitive. Secrets from env_template are written to stdout when exec rendering mode hits certain error conditions, primarily num_retries exhaustion. The realistic risk therefore hinges on whether an adversary can already read the Agent's stdout/logs (via log aggregation, shared terminal, process output capture, or compromised host), which is itself a meaningful prerequisite. No signals point to widespread or targeted exploitation; the patch (io.Discard on the output stream in dry mode) is a straightforward defensive fix. Missing data note: no CVSS vector was supplied by the vendor, so attack vector and privileges must be inferred from the description - treat the assessed vector below as analyst-derived, not vendor-confirmed.

An OpenBao Agent runs in exec rendering mode with secrets injected via env_template, and its stdout is captured by a centralized logging or container-orchestration pipeline. Transient upstream failures cause num_retries to be exhausted, and the Agent inadvertently prints previously rendered secrets to stdout, where they persist in logs. Any operator or process with read access to those logs - including a lower-privileged user who can view container/systemd output - can then harvest the leaked credentials. No public exploit code exists.