Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in OpenBao's certificate authentication method, specifically during the token renewal process. The root cause was an improper and weak validation check in the backend.pathLoginRenew function. When a token renewal was requested, the system attempted to verify that the client certificate presented matched the one used for the original authentication. However, instead of comparing the full certificates, it only compared the 'subject_key_id' and 'authority_key_id'. This is insecure because it's possible for an attacker to obtain a different certificate (a 'sibling' certificate) issued by the same Certificate Authority that would pass this check. This would allow the attacker to renew a token that did not belong to them, thereby extending their access and the lifetime of any dynamic leases associated with the token. The fix involved two main changes. First, the backend.pathLogin function was updated to store the complete raw certificate in the token's internal data upon initial login. Second, the backend.pathLoginRenew function was changed to discard the weak key ID check and instead perform a direct, constant-time comparison between the stored raw certificate and the one presented during the renewal request. This ensures that only the exact same certificate that was used for the initial login can be used for renewal.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openbao/openbao | go | < 0.0.0-20260420160924-abe84e1af4c3 | 0.0.0-20260420160924-abe84e1af4c3 |
