5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46405

CVE-2026-46405: OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

Impact

In OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in tokens being created with only the default policy, default TTL, and no entity information, which are hidden by the returned error message. No access to these tokens by the caller occurs and the authentication token is not ever made accessible outside of sys/raw. At most this could cause storage usage.

Patches

This is fixed in OpenBao v2.5.4.

Workarounds

Users may set a rate limit quota to limit the creation of these paths. As the path is unauthenticated, it isn't possible to deny access to it.

Reporter

This was discovered by an anonymous reporter.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46405

CVE-2026-46405:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openbao/openbao	go	<= 2.5.3	2.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-7j6w-vvw2-5f9c, allows for the creation of un-accessible tokens in OpenBao, leading to resource exhaustion. The root cause is within the Kerberos authentication method's GET handler, specifically the backend.pathLoginGet function in builtin/credential/kerberos/path_login.go. This function would incorrectly return a logical.Auth object along with an error message during the initial phase of Kerberos authentication. The core request handling logic in Core.handleRequest and Core.handleLoginRequest would then process this logical.Auth object and create a token, but since an error was also returned, the token's details were never sent to the client, causing it to be orphaned.

The patch addresses this issue comprehensively. First, it corrects the behavior of backend.pathLoginGet by removing the erroneous logical.Auth object from its response. Second, it introduces defensive checks in the core request handlers (Core.handleRequest and Core.handleLoginRequest) to explicitly prevent token creation if a backend returns both an Auth object and an error. This ensures that even if other authentication backends have similar incorrect implementations, the same vulnerability will not manifest.

Vulnerable functions

backend.pathLoginGet

builtin/credential/kerberos/path_login.go

This function, which handles the GET request for Kerberos login, was incorrectly returning an empty `logical.Auth` object. This, combined with the error that is also returned to initiate SPNEGO negotiation, triggered the core to create an orphaned token. The patch removes the `Auth` field from the response, fixing the root cause of the vulnerability within the Kerberos authentication backend.

Core.handleRequest

vault/request_handling.go

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.