What is GHSA-95v7-85fw-x99g?

GHSA-95v7-85fw-x99g is a security advisory published by GitHub Security Advisories with Low severity. OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the...

Which CVE IDs does GHSA-95v7-85fw-x99g cover?

GHSA-95v7-85fw-x99g covers the following CVE IDs: CVE-2026-115362. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-95v7-85fw-x99g?

GHSA-95v7-85fw-x99g has a CVSS v3 base score of 2.2, published by GitHub Security Advisories.

GHSA-95v7-85fw-x99gLowCVSS 2.2

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-115362 →

📋 Description

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.

🔗 References (4)

https://github.com/openbao/openbao/security/advisories/GHSA-7m59-mp95-w6ph
https://nvd.nist.gov/vuln/detail/CVE-2026-115362
https://www.vulncheck.com/advisories/openbao-before-2.6.4-and-2.7.0-before-2.7.1-expired-approle-secretid-authentication-bypass
https://github.com/advisories/GHSA-95v7-85fw-x99g