CVE-2026-115357

The record

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.

Affected packages

Related vulnerabilities

• CVE-2026-108311 Tanium addressed an insufficient logging vulnerability in Tanium Server. CWE-778
• CVE-2020-37268 Print Assumptions does not report that a definition was produced while universe checking… CWE-778
• CVE-2026-41709 VMware ESX contains an insufficient logging vulnerability. A malicious administrator… CWE-778
• GHSA-gfp8-mp24-5vxg @hulumi/baseline: CloudTrail selector tampering events were not fully detected CWE-778
• CVE-2026-32803 Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0… CWE-778
• CVE-2026-32693 In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is… CWE-778
• CVE-2025-52644 HCL AION is affected by a vulnerability where certain user actions are not adequately… CWE-778
• CVE-2026-25598 Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. CWE-778