CVE-2026-77285: OpenBao Agent Information Disclosure Flaw

CVE-2026-77285 Overview

CVE-2026-77285 affects OpenBao, an open source identity-based secrets management system. In versions prior to 2.6.0, the OpenBao Agent's exec rendering mode could write secrets from env_template to standard output. The issue occurs when command/agent/exec/exec.go re-creates the template runner after repeated rendering failures, primarily once num_retries is reached. Any process supervisor, log collector, or local user able to read that output stream can obtain the rendered secret values. This is an information disclosure weakness classified under [CWE-532: Insertion of Sensitive Information into Log File]. The issue is resolved in OpenBao 2.6.0.

Critical Impact
Rendered secret material intended for child processes can leak to stdout, exposing it to any supervisor, logging pipeline, or local user with read access to the agent's output.

Affected Products

OpenBao Agent versions prior to 2.6.0
Deployments using the agent exec rendering mode with env_template
Environments that capture agent stdout via process supervisors or log collectors

Discovery Timeline

2026-09-23 - CVE-2026-77285 published to NVD
2026-09-23 - Last updated in NVD database
Fix released - OpenBao v2.6.0 with patches in PR #3494 and PR #3495

Technical Details for CVE-2026-77285

Vulnerability Analysis

OpenBao Agent's exec mode renders secrets into environment variables (env_template) and passes them to a supervised child process. Under normal operation, the template runner writes rendered content to the child process rather than to the agent's own stdout. When template rendering encounters repeated failures and num_retries is exhausted, command/agent/exec/exec.go reconstructs the template runner. The re-created runner is initialized with a default output stream, so any previously rendered secret values can be flushed to the agent process's standard output. Downstream consumers of that stdout — systemd journals, container log drivers, sidecar shippers, or an interactive operator — then receive plaintext secret material they were never intended to see.

Root Cause

The root cause is a missing output redirection on runner reconstruction. In the vulnerable code path, the newly created runner did not have its output stream reassigned to io.Discard before s.runner.Start() was invoked. The fix explicitly discards the runner's output on the reinitialization branch, ensuring rendered content cannot reach the agent's stdout ([CWE-532]).

Attack Vector

Exploitation requires local access and high privileges, plus user interaction to induce repeated rendering failures. An adversary or curious local principal capable of reading the agent's stdout — for example through journalctl, a container runtime log endpoint, or a shared log collector — can capture rendered secrets after the retry threshold is crossed. The vulnerability does not enable remote exploitation and does not directly affect the integrity or availability of the OpenBao service.

			if err != nil {
				return fmt.Errorf("template server failed to create: %w", err)
			}
+
+			// prevent the templates from being rendered to stdout in "dry" mode
+			s.runner.SetOutStream(io.Discard)
+
			go s.runner.Start()

		case <-s.runner.TemplateRenderedCh():

Source: OpenBao commit 90272575 — the patch calls SetOutStream(io.Discard) on the reconstructed runner so rendered secrets never reach stdout.

Detection Methods for CVE-2026-77285

Indicators of Compromise

Secret-shaped strings (tokens, API keys, credentials) appearing in OpenBao Agent stdout, systemd journal entries, or container log streams.
OpenBao Agent log entries indicating repeated template rendering failures reaching the configured num_retries limit.
Unexpected access to agent log files or journalctl sessions targeting the OpenBao Agent unit by non-administrative users.

Detection Strategies

Grep captured agent stdout archives for known secret patterns and Vault/OpenBao token prefixes to identify historical exposure.
Correlate agent restart events and rendering error bursts with subsequent reads of the agent's log destination.
Audit which processes and users have read access to the agent's stdout stream, including sidecar log shippers and observability agents.

Monitoring Recommendations

Alert on OpenBao Agent template rendering errors that reach num_retries, since this is the precondition for the leak.
Monitor log collector pipelines for entries originating from the OpenBao Agent unit and flag high-entropy strings.
Track file and journal read access to agent log destinations and treat unexpected readers as a credential exposure event.

How to Mitigate CVE-2026-77285

Immediate Actions Required

Upgrade OpenBao to v2.6.0 or later on all hosts running the agent in exec mode.
Rotate any secrets that may have been rendered through env_template on affected agents, particularly where rendering failures were observed.
Purge historical agent stdout captures from journals, container log stores, and centralized logging platforms after preserving forensic copies.

Patch Information

The fix is delivered in OpenBao 2.6.0 via PR #3494 and backport PR #3495. The change in command/agent/exec/exec.go calls s.runner.SetOutStream(io.Discard) on the reconstructed template runner. Full advisory details are published as GHSA-444v-8vxr-p36h.

Workarounds

Restrict read access to the OpenBao Agent's stdout, systemd journal unit, and container log files to administrative principals only.
Redirect agent stdout to /dev/null or a tightly ACL'd file if upgrading immediately is not possible, accepting reduced operational visibility.
Reduce or disable retry-driven runner reconstruction paths by tuning num_retries and validating template sources so failures do not reach the threshold.

bash

# Verify installed OpenBao version and upgrade
bao version

# Example systemd hardening: restrict journal read access to the openbao unit
sudo setfacl -m g:adm:--- /var/log/journal
sudo systemctl edit openbao-agent
# In the override, ensure stdout is not world-readable:
# [Service]
# StandardOutput=file:/var/log/openbao/agent.out
# StandardError=journal
# UMask=0077