OpenBao PKI EUVD-2026-108292

Exploitation requires all of the following: the OpenBao PKI role must be configured with an allowed_ip_sans_cidr restriction; the use_csr_sans option must be enabled (this is the default); the caller must be authenticated and hold sign permission on that role; and the request must go through pki/sign/<role> with a CSR (the flaw does not affect the pki/issue path with ip_sans, which still enforces the CIDR). Limiting factors: the attacker must already be a trusted, authenticated principal with signing rights (PR:H), impact is confined to embedding an out-of-range IP SAN in an issued certificate (integrity only), and only versions 2.5.0 through 2.6.1 are affected - v2.6.2 is fixed.

This is a low-priority issue across every available signal, and the signals are mutually consistent rather than conflicting. The vendor CVSS 4.0 score is 2.1 (Low) with vector AV:N/AC:L/AT:P/PR:H/UI:N and only VI:L (limited integrity impact, no confidentiality or availability impact), reflecting that an already-privileged, authenticated caller can obtain a certificate for an IP outside the role's allowed CIDR - an authorization-restriction bypass (CWE-863), not a remote code or data-exposure flaw. The vuln.today Decision label is 'monitor', the lowest urgency tier, which aligns with the low score. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no working exploit code is supplied (only vendor/VulnCheck advisories), so there is no evidence of exploitation probability or active abuse. The practical impact is scoped narrowly: the attacker must already hold sign permission on a CIDR-restricted PKI role, so the vulnerability lets a trusted-but-constrained caller exceed its intended IP-SAN boundary rather than granting any new foothold. Net assessment: a genuine authorization bug worth patching on a normal maintenance cycle, not an emergency.

An authenticated operator who holds sign permission on an OpenBao PKI role that is CIDR-restricted via allowed_ip_sans_cidr crafts a CSR containing an IP SAN outside the permitted range and submits it to pki/sign/<role> with use_csr_sans enabled (the default). OpenBao fails to apply the CIDR check to CSR-sourced IP SANs and returns a CA-signed certificate embedding the unauthorized IP, even though the same IP would be rejected through pki/issue with ip_sans. No public working exploit code is identified; only vendor advisories exist.