CVE-2026-46405
Description
A flaw was found in OpenBao, an identity-based secrets management system. When the Kerberos authentication method processes a GET request or an Authorization: Negotiate header, it inadvertently creates authentication tokens that are not accessible to the caller and are hidden by an error message. These unaccessible tokens accumulate, potentially leading to a denial of service (DoS) by consuming system resources. A remote, unauthenticated attacker could trigger this condition.
Statement
Red Hat products do not ship the OpenBao server. Some products bundle the OpenBao API client library (github.com/openbao/openbao/api/v2) as a Go dependency, but this client module does not contain the vulnerable server-side Kerberos authentication handler where token accumulation occurs. The community packages (Fedora, EPEL) ship OpenBao 2.6.1 which includes the fix (2.5.4).
Mitigation
Update OpenBao to version 2.5.4 or later, which limits Kerberos authentication token accumulation.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
