CVE-2026-46358: 
Wolfi vulnerability analysis and mitigation

CVE-2026-46358 is an audit log redaction vulnerability in OpenBao's inline auth functionality, classified as "OpenBao's Inline Auth Incorrectly Redacted Headers." Due to an inverted conditional logic in the header-filtering code, non-auth (custom) headers were incorrectly removed from audit log entries while auth-related headers (including credentials passed via X-Vault-Inline-Auth-Parameter-* headers) were retained in cleartext. It affects OpenBao versions up to and including 2.5.3 (Go module github.com/openbao/openbao). The vulnerability was reported on May 12, 2026, published to the GitHub Advisory Database on May 28, 2026, and carries a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is a one-character logic inversion (CWE-532: Insertion of Sensitive Information into Log File) in vault/request_handling.go. In the CheckToken function, the loop intended to strip all inline-auth parameter headers from the request before audit logging used !strings.HasPrefix(header, consts.InlineAuthParameterHeaderPrefix) — deleting every header that did not carry the inline auth prefix, and leaving auth credential headers intact in cleartext. The fix (PR #3076, commit 131c696) corrects the condition to strings.HasPrefix(...), so that only headers bearing the inline auth prefix are deleted prior to logging. Exploitation requires an attacker to already have access to the audit device (e.g., read access to the audit log file or backend), making this a local, high-privilege precondition attack (GitHub Advisory, Fix Commit, Issue #3074).

An attacker with access to the OpenBao audit device can read authentication credentials and tokens — such as passwords or other secrets passed as inline auth parameters — in cleartext from audit log entries. This constitutes a confidentiality breach of source authentication material, which could be leveraged for credential reuse, privilege escalation, or lateral movement within systems that trust those credentials. Additionally, the incorrect redaction causes legitimate custom headers to be silently dropped from audit logs, undermining audit integrity and potentially masking attacker activity (GitHub Advisory, Issue #3074).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (audit device access) and passive user interaction, significantly limiting the attacker pool. No threat actor attribution has been reported.

1. Gain audit device access: Obtain read access to the OpenBao audit log file or backend (e.g., via a compromised system account, misconfigured file permissions, or a privileged insider role on the host running OpenBao ≤ 2.5.3).
2. Identify inline auth usage: Confirm that the target OpenBao deployment uses inline auth by observing requests with X-Vault-Inline-Auth-Path and X-Vault-Inline-Auth-Parameter-* headers (e.g., via network monitoring or existing log entries).
3. Read audit logs: Access the audit log file (e.g., /tmp/audit.log or the configured audit backend) and parse JSON entries for requests where headers contains keys prefixed with x-vault-inline-auth-parameter-.
4. Extract credentials: Retrieve the base64-encoded or plaintext credential values from the retained auth parameter headers (e.g., x-vault-inline-auth-parameter-password) in the audit log entries.
5. Reuse credentials: Decode and use the extracted credentials to authenticate to OpenBao or downstream systems, enabling privilege escalation or lateral movement (Issue #3074, GitHub Advisory).

• Logs: Audit log entries (JSON) containing headers with the prefix x-vault-inline-auth-parameter- on non-auth-path requests (e.g., sys/audit, sys/mounts) — these should have been redacted in a correctly functioning system.
• Logs: Absence of custom (non-inline-auth) headers such as x-custom-header in audit log entries for authenticated endpoint requests when inline auth is in use — indicating the buggy redaction behavior is active.
• File System: Unexpected read access or access timestamps on the OpenBao audit log file by accounts other than the OpenBao service account.
• Process/Access: Unusual processes or users reading the audit log file path (e.g., /tmp/audit.log or the configured file_path in the audit stanza) (Issue #3074).

Upgrade to OpenBao v2.5.4, which contains the fix for this vulnerability (OpenBao v2.5.4 Release). No configuration-based workaround is available; patching is the only remediation. After upgrading, operators should review audit logs for any retained x-vault-inline-auth-parameter-* header values and rotate all potentially exposed authentication credentials and tokens as appropriate (GitHub Advisory). Additionally, restrict access to the audit device and audit log files to the minimum necessary principals.