CVE-2026-126310 — Openbao
HIGHCVE-2026-126310 is a high-severity (CVSS 8.7) Improper Authentication vulnerability in openbao openbao. A fix is available — see the affected versions and patch details below.
OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials…
Description
OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret.
Affected Products
openbaoopenbaoDetection & mitigation playbook
Vendor / applianceDetect
Inventory every openbao openbao deployment and check each version against the affected-products list above.
Fix
Apply the openbao openbao security patch or hotfix for CVE-2026-126310 on the affected version, following the vendor advisory for your exact build.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-126310 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.