CVE-2026-77285CWE-532

CVE-2026-77285

published September 23, 2026

CVSS
2.4
EPSS
0%
Percentile
2.0
In the wild
Unconfirmed
What it is

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

The record
Technical detail
CVSS
2.4 · NONE
CVSS v4.0
2.4 · CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00125 · 2.0th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-09-23T23:19Z
References (6)
https://github.com/openbao/openbao/commit/90272575e5f58b3883fbb0ccb2238e9285722d1a · [email protected]https://github.com/openbao/openbao/commit/ee3aa4aff72c5176cf02af21eac7158899080878 · [email protected]https://github.com/openbao/openbao/pull/3494 · [email protected]https://github.com/openbao/openbao/pull/3495 · [email protected]https://github.com/openbao/openbao/releases/tag/v2.6.0 · [email protected]https://github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h · [email protected]
EPSS history
Timeline
  • 25 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 23 SEP 17:59Z
    OpenBao Agent Writes Secrets to Stdout
    cvelistv5