CVE-2026-77285

Severity CVSS v4.0:

LOW

Type:

CWE-532 Information Exposure Through Log Files

Publication date:

23/09/2026

Last modified:

29/09/2026

Description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent&#39;s exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

Impact

Vector 4.0

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H CVSS v4.0 Severity and Metrics:

Base Score: 2.40 LOW
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H

Attack Vector (AV): Local
Attack Complexity (AC): Low
Attack Requirements (AT): Present
Privileges Required (PR): High
User Interaction (UI): Active
Confidentiality (VC): Low
Integrity (VI): None
Availability (VA): None
Confidentiality (SC): High
Integrity (SI): High
Availability (SA): High

Base Score 4.0

2.40

Severity 4.0

LOW

CVE-2026-77285

Description

Impact

References to Advisories, Solutions, and Tools