SCA: security update for github.com/openbao/openbao (GHSA-7j6w-vvw2-5f9c)

medium Tenable Cloud Security Plugin ID 442429

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's
Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the
response is includes a `logical.Auth` object in addition to an error message. This results in tokens being
created with only the default policy, default TTL, and no entity information, which are hidden by the
returned error message. No access to these tokens by the caller occurs and the authentication token is not
ever made accessible outside of `sys/raw`. This is fixed in OpenBao v2.5.4. As a workaround, users may set
a rate limit quota to limit the creation of these paths. As the path is unauthenticated, it isn't possible
to deny access to it. (CVE-2026-46405)

Solution

Update the github.com/openbao/openbao library and its related packages to version 2.5.4 or later.

Plugin Details

Severity: Medium

ID: 442429

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/28/2026

Updated: 8/10/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-46405

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/28/2026

Vulnerability Publication Date: 5/28/2026

Reference Information

CVE: CVE-2026-46405

cwe: CWE-770

Detections

Analytics