O
Vendor security profile
openbao
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs14
Critical1
CISA KEV0
Public exploit3
Patch rate%21
Avg. CVSS5.9
12-month vulnerability rate
0
0
0
0
2
0
0
0
0
3
8
0
CVE KEV
CVE severity distribution
14toplam CVE
Critical1 (7%)
High4 (29%)
Medium6 (43%)
Low3 (21%)
Patch and exploitation view
%21
Verified patch
%0
CISA KEV
%21
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
11Unknown
Latest vulnerabilities
9.2
CVE-2026-63132
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
O
Patch status unknownEPSS %0
6.0
CVE-2026-63131
OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)
O
Patch status unknownEPSS %0
2.4
CVE-2026-77285
OpenBao Agent Writes Secrets to Stdout
O
Patch status unknownEPSS %0
7.5
CVE-2026-71543
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
O
Patch status unknownEPSS %0
6.8
CVE-2026-55770
OpenBao: LDAPi ldaputil (wrong escape func)
O
Patch status unknownEPSS %1
6.5
CVE-2026-55776
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
O
Patch status unknownEPSS %1
2.1
CVE-2026-55774
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808
O
Patch status unknownEPSS %1
2.3
CVE-2026-55775
OpenBao's System Backend allows Unauthorized Management of the containing Namespace
O
Patch status unknownEPSS %0
7.1
CVE-2026-45808
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
O
Patch status unknownEPSS %0
5.3
CVE-2026-46405
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
O
Patch status unknownEPSS %1