CVE-2026-115357

2.2 LOWpublic exploit available

Published 2026-10-22 · Updated 2026-10-23

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-778

Public exploit & PoC references

https://github.com/openbao/openbao/security/advisories/GHSA-q74w-hv5x-6hxf

All references

https://github.com/openbao/openbao/security/advisories/GHSA-q74w-hv5x-6hxf
https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-improper-audit-logging-of-root-generation-and-rekey-responses

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-105243PoC
MEDIUMCVE-2026-18161
HIGHCVE-2026-85959

Related by shared AI tags and CWE weakness class. Browse the full archive.