What is GHSA-h7rj-f8m2-hv6h?

GHSA-h7rj-f8m2-hv6h is a security advisory published by GitHub Security Advisories with Low severity. OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to...

Which CVE IDs does GHSA-h7rj-f8m2-hv6h cover?

GHSA-h7rj-f8m2-hv6h covers the following CVE IDs: CVE-2026-115358. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h7rj-f8m2-hv6h?

GHSA-h7rj-f8m2-hv6h has a CVSS v3 base score of 2.0, published by GitHub Security Advisories.

GHSA-h7rj-f8m2-hv6hLowCVSS 2.0

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-115358 →

📋 Description

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.

🔗 References (4)

https://github.com/openbao/openbao/security/advisories/GHSA-8xxq-mq9m-xmhw
https://nvd.nist.gov/vuln/detail/CVE-2026-115358
https://www.vulncheck.com/advisories/openbao-before-2.6.3-sensitive-data-leak-in-audit-log-via-malformed-parameters
https://github.com/advisories/GHSA-h7rj-f8m2-hv6h