CVE-2026-115359
Low · 3.7CVSS
3.7
EPSS
0.2%
Published
Oct 22, 2026
CISA due date
—
The record
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63399 Coop is an open source review and moderation tool from ROOST. CWE-799
- CVE-2026-116007 A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. CWE-799
- CVE-2026-115480 baserCMS is a website development framework. CWE-799
- CVE-2026-96364 Improper Control of Interaction Frequency vulnerability in Drupal Webform allows… CWE-799
- CVE-2026-85586 phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set… CWE-799
- CVE-2026-54738 Lemmy is a link aggregator and forum for the fediverse. CWE-799
- CVE-2026-75773 A vulnerability was found in karakeep-app karakeep up to 0.32.0. CWE-799
- CVE-2026-19898 A vulnerability was found in VictoriaMetrics up to 1.146.0. CWE-799