CVE-2026-46358: OpenBao Information Disclosure Vulnerability

CVE-2026-46358 Overview

OpenBao is an open source identity-based secrets management system. CVE-2026-46358 describes an information exposure flaw in the inline authentication code path prior to version 2.5.4. The redaction logic inverted its condition, causing non-authentication headers to be stripped from audit log entries while authentication-related headers were retained in cleartext.

The defect maps to [CWE-532] Insertion of Sensitive Information into Log File. Exploitation requires an attacker who already has access to the audit device. Operators are advised to review any leaked source authentication material captured in audit logs and rotate the affected credentials. The issue is fixed in OpenBao v2.5.4.

Critical Impact
Authentication headers processed by inline auth were written to audit logs in cleartext, exposing credential material to anyone with access to the audit device.

Affected Products

OpenBao versions prior to 2.5.4
OpenBao deployments using inline auth functionality
Audit devices receiving inline auth request logs

Discovery Timeline

2026-08-07 - CVE CVE-2026-46358 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-46358

Vulnerability Analysis

OpenBao's inline authentication feature passes credential material through HTTP headers prefixed with consts.InlineAuthParameterHeaderPrefix. Before writing an audit log entry, the request handler is supposed to strip these authentication headers so they do not persist in cleartext.

The redaction routine in vault/request_handling.go contained an inverted conditional. Instead of removing headers whose name began with the inline auth prefix, the code removed every other header and left the authentication headers intact. Any operator or attacker with access to the audit device could then read source authentication material directly from log entries.

Root Cause

The root cause is a logic inversion in header filtering. The loop iterated over req.Headers and deleted a header only when its name did not start with the inline auth prefix. The intended behavior was the opposite: delete only headers that start with the prefix. See the GitHub Security Advisory GHSA-q8cj-789h-vg24 for the full advisory.

Attack Vector

The attack vector is local and requires high privileges. An adversary must first compromise access to the OpenBao audit device, such as the file, socket, or syslog sink where audit entries are written. Once access is obtained, the adversary can harvest authentication headers from historical or streaming audit records and reuse the credentials against the OpenBao API.

// Patch from vault/request_handling.go (#3076)
		delete(req.Headers, consts.InlineAuthPathHeaderName)
		delete(req.Headers, consts.InlineAuthOperationHeaderName)
		for header := range req.Headers {
-			if !strings.HasPrefix(header, consts.InlineAuthParameterHeaderPrefix) {
+			if strings.HasPrefix(header, consts.InlineAuthParameterHeaderPrefix) {
				delete(req.Headers, header)
			}
		}
// Source: https://github.com/openbao/openbao/commit/131c6966af4dfb4e1906703436eecdb8f2a3e9df

The patch flips the condition so that headers beginning with the inline auth prefix are the ones removed before the request is audited.

Detection Methods for CVE-2026-46358

Indicators of Compromise

Audit log entries from OpenBao versions before 2.5.4 that contain HTTP header names starting with the inline auth parameter prefix.
Audit records for inline auth requests where custom, non-auth headers are absent while auth-related headers are present.
API activity from source addresses that previously read the audit device followed by successful authentications using inline auth credentials.

Detection Strategies

Grep or query the audit backend for retained inline auth header names in historical entries to identify exposed credentials.
Correlate audit device read events, such as file opens or syslog forwarder activity, with subsequent OpenBao authentication events reusing the same credentials.
Compare OpenBao binary versions across the fleet against the fixed release v2.5.4 and flag hosts running earlier builds.

Monitoring Recommendations

Restrict and monitor filesystem and network access to any file, socket, or syslog destination configured as an OpenBao audit device.
Alert on unexpected processes or identities reading OpenBao audit output.
Track OpenBao release consumption using package inventory to ensure upgrades to v2.5.4 or later are applied.

How to Mitigate CVE-2026-46358

Immediate Actions Required

Upgrade OpenBao to v2.5.4 or later. See GitHub Release Notes v2.5.4.
Review all audit log entries generated by pre-2.5.4 versions for retained inline auth headers and treat any observed credentials as compromised.
Rotate authentication material that may have been logged, including tokens, secret IDs, and any inline-auth-supplied credentials.
Tighten access controls on audit sinks and rotate credentials for identities that had read access to those sinks.

Patch Information

The fix is delivered in OpenBao v2.5.4 through pull request #3076 and commit 131c6966af4dfb4e1906703436eecdb8f2a3e9df. The change corrects the header filter in vault/request_handling.go so that headers prefixed with consts.InlineAuthParameterHeaderPrefix are deleted before audit serialization. Tracking discussion is available in GitHub issue #3074.

Workarounds

Disable inline auth usage until the upgrade to v2.5.4 is complete.
Route audit output to a sink with strict access controls and integrity monitoring so only trusted operators can read entries.
Purge or archive pre-patch audit logs to storage with restricted access after harvesting them for credential-rotation evidence.

bash

# Verify installed OpenBao version and upgrade if below 2.5.4
bao version
# Expected: OpenBao v2.5.4 or later

# Restrict audit file permissions (file audit device example)
chown openbao:openbao /var/log/openbao/audit.log
chmod 600 /var/log/openbao/audit.log