OpenBao EUVD-2026-108284

Exploitation requires that the target OpenBao deployment has rate-limit quota rules scoped to backend-specific roles configured; without such role-scoped quotas there is nothing to bypass. The bypass is triggered specifically by sending requests with form-encoded bodies or by presenting forwarded client certificates, which cause role resolution to fail so the quota is not enforced. The actor must be a caller otherwise able to request tokens from the affected backend ('valid callers' per the advisory), which limits this to parties with legitimate access to the token-issuance path rather than fully anonymous attackers - note this tension with the CVSS PR:N. Versions before 2.6.4 and 2.7.0 through before 2.7.1 are affected; the only complete fix stated by the vendor is upgrading to 2.6.4 or 2.7.1.

This is a moderate-severity control-bypass, not an urgent emergency. The vendor CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N) reflects network reachability with low complexity but a present attack requirement (AT:P) - the bypass only occurs on specific request-parsing paths (form-encoded bodies or forwarded certificates). The only impact metric set is VA:L (low availability on the vulnerable system); confidentiality and integrity are N, consistent with CWE-799 (improper control of interaction frequency / rate-limit bypass) and inconsistent with the input's 'Information Disclosure' tag - nothing in the evidence supports data disclosure. There is a notable signal conflict on privileges: the CVSS vector asserts PR:N (unauthenticated), yet the advisory repeatedly states the flaw lets 'valid callers' issue tokens, which implies the actor must already be an authorized caller capable of requesting tokens - verify authentication expectations with the vendor rather than treating this as anonymous abuse. No EPSS score, no CISA KEV listing, and no verified exploit code were provided; the two references are vendor/coordination advisories (GHSA and VulnCheck), not proof-of-concept exploits. The vuln.today decision label is 'this_month', aligning with a patch-on-normal-cadence posture rather than act_now/emergency. Net: a real but contained operational-control weakness whose main effect is defeating role-scoped rate-limit budgets, worth patching within a normal maintenance window.

A legitimate OpenBao caller that is subject to a backend-specific, role-scoped rate-limit quota crafts its token-issuance requests using form-encoded bodies (or presents forwarded client certificates). Because role resolution fails on these request shapes, the quota subsystem does not attribute the requests to the configured role, so the caller mints tokens repeatedly without ever consuming its configured budget. No public exploit code was identified at time of analysis; only vendor and coordinator advisories exist.