CVE-2026-115356

The record

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.

Affected packages

Related vulnerabilities

• CVE-2026-63400 Coop is an open source review and moderation tool from ROOST. CWE-613
• CVE-2026-116251 pgAdmin 4 did not invalidate a user's existing sessions when their password changed… CWE-613
• CVE-2026-119577 ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows… CWE-613
• CVE-2026-118665 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-613
• CVE-2026-6647 In deployments of WSO2 Identity Server configured with a case-insensitive user store and… CWE-613
• CVE-2026-3583 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection… CWE-613
• CVE-2026-117499 @fastify/session is a session plugin for Fastify. CWE-613
• CVE-2026-116894 REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that… CWE-613