CVE-2026-115356
Description
A flaw was found in OpenBao. When renewing an access token issued through the Kubernetes authentication method, OpenBao fails to verify whether the underlying Kubernetes service account remains valid. An authenticated attacker can exploit this issue by repeatedly renewing their token to maintain persistent access to the system even after the associated service account has been deleted or revoked.
Statement
This vulnerability is rated as Moderate severity because successful exploitation requires an existing authenticated session and valid credentials initially recognized by the cluster. An adversary can only maintain unauthorized persistence if they already obtained an active token prior to the decommissioning of the associated account, rather than gaining new or elevated privileges. Furthermore, OpenBao is not shipped or enabled by default across Red Hat enterprise software, limiting exposure in supported deployments.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
