CVE-2026-115357
Description
A flaw was found in OpenBao. Under certain conditions, the service fails to record audit log entries for responses when processing requests to generate root tokens or rotate encryption keys. A remote attacker can complete these critical operations without leaving a complete audit trail, hindering security monitoring and forensic investigation.
Statement
This vulnerability is rated as having Low severity because the unauthenticated endpoints are disabled by default and the corresponding request events remain recorded in the audit logs. Exploiting this issue requires specific conditions where the response logging mechanism fails independently of request logging during root token generation or key rotation. Furthermore, unauthorized access to these operations typically requires existing administrative privileges or a quorum of unseal keys, limiting the blast radius to incomplete forensic tracking rather than unauthorized privilege acquisition.
Understanding the Weakness (CWE)
Non-Repudiation
Technical Impact: Hide Activities
Malicious behavior can become more difficult to detect, such as a failed login attempt. This may hinder forensic analysis after an attack succeeds. There will be no trail for forensic analysis, and discovering the cause of problems or the source of attacks may become more difficult or impossible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
