LOW
GHSA-444v-8vxr-p36h
OpenBao Agent Writes Secrets to Stdout
Quick fix
GHSA-444v-8vxr-p36h — github.com/openbao/openbao: upgrade to the fixed version with the command below.
go get github.com/openbao/openbao@v0.0.0-20260714163218-90272575e5f5Details
### Impact
During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in `env_template` to stdout. This primarily happens when `num_retries` is met.
This vulnerability is original to Vault and was reported via the OpenBao security mailing list.
### Patches
This is addressed in OpenBao v2.6.0 GA.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/openbao/openbao
Introduced in:
0Fixed in: 0.0.0-20260714163218-90272575e5f5Fix
go get github.com/openbao/openbao@v0.0.0-20260714163218-90272575e5f5Go/github.com/openbao/openbao
Introduced in:
0.1.0No fixed version published yet for github.com/openbao/openbao (go modules). Pin to a known-safe version or switch to an alternative.
References
- https://github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h[WEB]
- https://github.com/openbao/openbao/pull/3494[WEB]
- https://github.com/openbao/openbao/pull/3495[WEB]
- https://github.com/openbao/openbao/commit/90272575e5f58b3883fbb0ccb2238e9285722d1a[WEB]
- https://github.com/openbao/openbao/commit/ee3aa4aff72c5176cf02af21eac7158899080878[WEB]
- https://github.com/openbao/openbao[PACKAGE]
- https://github.com/openbao/openbao/releases/tag/v2.6.0[WEB]