GitHub Advisoryadvisory · Go
GHSA-444v-8vxr-p36h OpenBao Agent Writes Secrets to Stdout
LOW
Official page ↗
- Aliases
- CVE-2026-77285
- Ecosystem
- Go
- Packages
- github.com/openbao/openbao
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H
- Weaknesses
- CWE-532
- Reviewed
- 2026-09-22
Affected packages
• Go github.com/openbao/openbao: < 0.0.0-20260714163218-90272575e5f5 → fixed in 0.0.0-20260714163218-90272575e5f5
• Go github.com/openbao/openbao: >= 0.1.0, <= 1.1.5 (no fix yet)
Description
Impact
During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in `env_template` to stdout. This primarily happens when `num_retries` is met.
This vulnerability is original to Vault and was reported via the OpenBao security mailing list.
Patches
This is addressed in OpenBao v2.6.0 GA.
Related
Alias · CVE (1)
- CVE-2026-77285 OpenBao is an open source identity-based secrets management system. vulnerability
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness
References
- https://github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h web
- https://github.com/openbao/openbao/pull/3494 web
- https://github.com/openbao/openbao/pull/3495 web
- https://github.com/openbao/openbao/commit/90272575e5f58b3883fbb0ccb2238e9285722d1a web
- https://github.com/openbao/openbao/commit/ee3aa4aff72c5176cf02af21eac7158899080878 web
- https://github.com/openbao/openbao package
- https://github.com/openbao/openbao/releases/tag/v2.6.0 web