CVE-2026-46405: OpenBao Kerberos Auth Bypass Vulnerability

CVE-2026-46405 Overview

CVE-2026-46405 affects OpenBao, an open source identity-based secrets management system. Versions prior to 2.5.4 issue hidden authentication tokens through the Kerberos auth method. The flaw occurs when the GET handler is invoked or when a request supplies an Authorization: Negotiate header. The response returns a logical.Auth object alongside an error message, causing token creation with only the default policy, default TTL, and no entity information. The caller never receives these tokens, and they remain accessible only through sys/raw. The vulnerability is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Unauthenticated network requests to the Kerberos auth endpoint create orphaned default-policy tokens, exhausting token storage resources over time.

Affected Products

OpenBao versions prior to 2.5.4
OpenBao deployments with the Kerberos auth method enabled
OpenBao instances accepting Authorization: Negotiate headers

Discovery Timeline

2026-08-07 - CVE-2026-46405 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-46405

Vulnerability Analysis

The defect resides in the Kerberos credential backend's login path handler at builtin/credential/kerberos/path_login.go. The pathLoginGet function returns a logical.Response containing an empty logical.Auth{} struct together with a www-authenticate: Negotiate header. When the OpenBao core observes both an authentication object and an error in the same response, it still triggers the token issuance workflow. This produces a token bound only to the default policy with the default TTL and no associated entity. The token is never exposed in the HTTP response body, so the caller cannot use it. However, the token persists in storage and remains discoverable through the privileged sys/raw endpoint.

Root Cause

The root cause is improper error handling that permits token allocation during an unauthenticated initial negotiation phase. Any error returned by the handler should short-circuit token creation, but the coexistence of Auth and error data bypassed that safeguard.

Attack Vector

A remote unauthenticated attacker sends repeated GET requests or requests with an Authorization: Negotiate header to the Kerberos login endpoint. Each request causes the server to create a hidden orphaned token. Sustained abuse consumes storage and token accounting resources, degrading availability.

// Patch: builtin/credential/kerberos/path_login.go
func (b *backend) pathLoginGet(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
	return &logical.Response{
-		Auth: &logical.Auth{},
		Headers: map[string][]string{
			"www-authenticate": {"Negotiate"},
		},

Source: OpenBao commit 0d82e0a

Detection Methods for CVE-2026-46405

Indicators of Compromise

Unusually high volume of GET requests to the Kerberos login path from unauthenticated sources
Growing count of orphaned tokens with default policy and no entity binding visible only through sys/raw
Repeated inbound requests carrying an Authorization: Negotiate header without completing negotiation

Detection Strategies

Audit OpenBao token storage for tokens with default policy attachment and empty entity identifiers created from the Kerberos backend
Correlate Kerberos login path access logs with token creation events in the OpenBao audit log
Alert on rate anomalies for unauthenticated hits against auth/kerberos/login

Monitoring Recommendations

Enable OpenBao audit devices and forward events to a centralized log platform for retention and query
Track token count growth per auth mount and alert on abnormal deltas
Monitor storage backend size and token accounting metrics exposed via the OpenBao telemetry endpoints

How to Mitigate CVE-2026-46405

Immediate Actions Required

Upgrade OpenBao to version 2.5.4 or later, which removes the empty logical.Auth{} object from the initial negotiation response
Review existing token storage for orphaned tokens issued by the Kerberos backend and revoke them
Restrict network exposure of the OpenBao API to trusted clients where feasible

Patch Information

The fix is included in OpenBao v2.5.4. The change is described in Pull Request #3150 and the GHSA-7j6w-vvw2-5f9c advisory. The patch removes the Auth: &logical.Auth{} field from the pathLoginGet response so that core does not create a hidden token during initial negotiation.

Workarounds

Apply a rate limit quota to the Kerberos login path to slow orphaned token creation, since the endpoint is unauthenticated and cannot be denied outright
Periodically enumerate and revoke orphaned tokens through administrative tooling until the patch is deployed

bash

# Configuration example: apply a rate limit quota to the Kerberos login path
bao write sys/quotas/rate-limit/kerberos-login \
    path="auth/kerberos/login" \
    rate=10 \
    interval=1m