CVE-2026-115369: 
Wolfi vulnerability analysis and mitigation

CVE-2026-115369 is a PKI authorization bypass vulnerability in OpenBao where the allowed_ip_sans_cidr role restriction is not enforced for IP Subject Alternative Names (SANs) taken from a Certificate Signing Request (CSR) when use_csr_sans is enabled. It affects OpenBao versions 2.5.0 through 2.6.1 (before 2.6.2) and was published on October 22, 2026. The vulnerability was assigned a CVSS v3.1 base score of 2.2 (Low) and a CVSS v4.0 base score of 2.1 (Low), reflecting the high privilege requirement and limited integrity impact (GitHub Advisory, VulnCheck).

The root cause is Incorrect Authorization (CWE-863): the PKI engine correctly validates allowed_ip_sans_cidr when IP SANs are supplied via the API parameter ip_sans on the pki/issue/<role> endpoint, but fails to apply the same CIDR restriction to IP SANs extracted from a submitted CSR on the pki/sign/<role> endpoint when use_csr_sans=true (the default configuration). An authenticated caller with sign permission on a CIDR-restricted PKI role can craft a CSR embedding an out-of-range IP SAN and submit it to pki/sign/<role>, receiving a CA-signed certificate containing the unauthorized IP address. The attack requires network access, high privileges (sign permission on the role), and the presence of the use_csr_sans=true configuration (GitHub Advisory).

Successful exploitation allows an authenticated attacker to obtain CA-signed certificates embedding IP addresses outside the CIDR ranges permitted by the PKI role policy, effectively bypassing certificate issuance controls. This undermines the integrity of the PKI infrastructure and could enable certificate spoofing or man-in-the-middle attacks against services that trust the OpenBao CA. There is no confidentiality or availability impact; the scope is limited to integrity of issued certificates within the vulnerable system (GitHub Advisory, VulnCheck).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with sign permission on a CIDR-restricted PKI role, significantly limiting the attacker pool (GitHub Advisory, VulnCheck).

1. Obtain credentials: Acquire an OpenBao token or authentication credential with sign permission on a PKI role that has allowed_ip_sans_cidr configured and use_csr_sans=true (the default).
2. Identify the target role: Enumerate accessible PKI roles to find one with CIDR-restricted IP SANs using the OpenBao API (e.g., GET /v1/pki/roles/<role>).
3. Generate a malicious CSR: Using a tool such as OpenSSL, generate a CSR that includes an IP SAN outside the role's permitted CIDR range:

   openssl req -new -key private.key -out malicious.csr -config san.cnf

   where san.cnf specifies an IP SAN (e.g., subjectAltName = IP:10.99.99.99) that falls outside the allowed CIDR.
4. Submit the CSR to pki/sign: POST the CSR to the pki/sign/<role> endpoint:

   curl --header "X-Vault-Token: <token>" \
        --request POST \
        --data '{"csr": "<PEM-encoded CSR>"}' \
        https://<openbao-host>/v1/pki/sign/<role>

5. Receive unauthorized certificate: The OpenBao server returns a CA-signed certificate embedding the out-of-range IP SAN, bypassing the allowed_ip_sans_cidr restriction (GitHub Advisory).

• Logs: OpenBao audit logs showing pki/sign/<role> requests where the resulting certificate contains IP SANs outside the role's configured allowed_ip_sans_cidr ranges; compare issued certificate IP SANs against role policy in audit records.
• Network: Unexpected TLS certificates presented by internal services bearing IP SANs inconsistent with their assigned address ranges, potentially detectable via certificate transparency monitoring or internal TLS inspection.
• File System: Certificates issued by the OpenBao CA stored on hosts with IP SANs that do not match the host's actual IP address or authorized CIDR blocks.

Upgrade OpenBao to version 2.6.2 or later, which patches the enforcement gap so that allowed_ip_sans_cidr is applied consistently to IP SANs from both API parameters and CSR submissions. As a temporary workaround, administrators can set use_csr_sans=false on affected PKI roles to prevent IP SANs from being taken from CSRs, forcing callers to supply IP SANs via the API where the restriction is correctly enforced. Audit existing issued certificates for any that contain IP SANs outside permitted CIDR ranges and revoke them as appropriate (GitHub Advisory).

The vulnerability was reported by security researcher AkshayJainG and the advisory was published by OpenBao maintainer cipherboy on August 18, 2026 (CVE assigned October 22, 2026). No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).