Bug 2559262 (CVE-2026-115363)

Summary: CVE-2026-115363 github.com/openbao/openbao: OpenBao: Information disclosure via sanitized configuration endpoint
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenBao. When External Account Binding (EAB) is configured with the Automatic Certificate Management Environment (ACME) to manage certificates, the sanitized configuration endpoint fails to redact the EAB Message Authentication Code (MAC) key. An authenticated user with permission to query the sanitized configuration endpoint can retrieve this sensitive key, resulting in information disclosure and allowing unauthorized binding to the operator's ACME account.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-22 19:47:50 UTC 
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.