Skip to content

openbao

v2.5.4 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 14d Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

go secrets-management security

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Broad release touches BUG FIXES, core, https://github.com/openbao/openbao/pull/3150, and storage/postgresql.

Changes in this release

Security Medium

Fix audit logs dropping custom headers when using inline auth.

Fix audit logs dropping custom headers when using inline auth.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Security Medium

Prevent hidden default token issuance from auth plugin endpoints returning both a logical.Auth{} response object and an error.

Prevent hidden default token issuance from auth plugin endpoints returning both a logical.Auth{} response object and an error.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Security Medium

Remove legacy lease endpoints due to cross-namespace lease modification.

Remove legacy lease endpoints due to cross-namespace lease modification.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Breaking Medium

Fix /v1/sys/ forwarding regressions for standby instances.

Fix /v1/sys/ forwarding regressions for standby instances.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Breaking Medium

Disallow logical secret engines from creating authentication tokens.

Disallow logical secret engines from creating authentication tokens.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Feature Medium

Forward generate-root, step-down and rekey requests to active node to resolve inconsistent standby behavior.

Forward generate-root, step-down and rekey requests to active node to resolve inconsistent standby behavior.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: high

 —
Feature Medium

Set constraint name to table_pkey and ha_table_pkey and index to table_idx for uniqueness when reusing the same database partition for multiple OpenBao instances.

Set constraint name to table_pkey and ha_table_pkey and index to table_idx for uniqueness when reusing the same database partition for multiple OpenBao instances.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Feature Medium

Add release notes for v2.5.4.

Add release notes for v2.5.4.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Feature Medium

Set constraint names and index names uniquely for PostgreSQL storage when reusing database partitions across OpenBao instances.

Set constraint names and index names uniquely for PostgreSQL storage when reusing database partitions across OpenBao instances.

Source: granite4.1:30b@2026-05-20-audit

Confidence: low

 —
Performance Medium

Wait for autopilot shutdown to avoid panic when racing to retrieve known servers.

Wait for autopilot shutdown to avoid panic when racing to retrieve known servers.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Deprecation Medium

Remove legacy cross-namespace lease endpoints.

Remove legacy cross-namespace lease endpoints.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: high

 —
Bugfix Medium

Do not return logical.Auth{} response during initial negotiation at the same time as an error.

Do not return logical.Auth{} response during initial negotiation at the same time as an error.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: high

 —
Bugfix Medium

Handle invalidation for login MFA, ensuring standby nodes respond appropriately on writes.

Handle invalidation for login MFA, ensuring standby nodes respond appropriately on writes.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: high

 —
Bugfix Medium

Fix list_scan_response_keys_filter_path incorrectly erring on empty list responses.

Fix list_scan_response_keys_filter_path incorrectly erring on empty list responses.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: high

 —
Bugfix Medium

Correctly handle default rate limit exempt paths on quota configuration invalidation.

Correctly handle default rate limit exempt paths on quota configuration invalidation.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: high

 —
Bugfix Medium

Correctly handle default_rate_limit_exempt_paths_toggle invalidation.

Correctly handle default_rate_limit_exempt_paths_toggle invalidation.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: high

 —
Bugfix Medium

Prevent errors from creating orphaned tokens.

Prevent errors from creating orphaned tokens.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Refactor Medium

Revert accidental rename of ha_table option to haTable; both spellings now supported.

Revert accidental rename of ha_table option to haTable; both spellings now supported.

Source: granite4.1:8b-q6_K@2026-05-20

Confidence: low

 —
Full changelog

SECURITY

  • core/auth: Fix audit logs dropping custom headers when using inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  • core: Prevent hidden default token issuance from auth plugin endpoints returning both a logical.Auth{} response object and an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  • core: Remove legacy lease endpoints (sys/revoke, sys/renew, sys/revoke-prefix, and sys/revoke-force) due to cross-namespace lease modification. GHSA-v8v8-cm84-m686 / CVE-2026-45808. [GH-3152]

IMPROVEMENTS

  • storage/postgresql: Set constraint name to table+"_pkey" and ha_table+"_pkey" and index to table+"_idx" for uniqueness when reusing the same database partition for multiple OpenBao instances. [GH-2876]

BUG FIXES

  • auth/kerberos: Do not return logical.Auth{} response during initial negotiation at the same time as an error. [GH-3150]
  • core/mfa: Handle invalidation for login MFA, ensuring standby nodes respond appropriately on writes. [GH-3083]
  • core/policies: Fix list_scan_response_keys_filter_path incorrectly erring on empty list responses. [GH-3063]
  • core/quotas: Correctly handle default rate limit exempt paths on quota configuration invalidation. [GH-2953]
  • core: Disallow logical secret engines from creating authentication tokens. [GH-3087]
  • core: Forward generate-root, step-down and rekey requests to active node to resolve inconsistent standby behavior. [GH-3006]
  • storage/raft: Wait for autopilot shutdown to avoid panic when racing to retrieve known servers. [GH-3054]
  • storage/postgresql: Revert accidental rename of ha_table option to haTable. Both spellings are now supported to retain compatibility, though ha_table takes precedence. [GH-2876]

What's Changed

  • Remove 2.5.x community docs by @cipherboy in https://github.com/openbao/openbao/pull/3071
  • Disallow non-auth plugins from creating tokens (#3087 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3112
  • Handle invalidation of LoginMFA keys (#3083 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3113
  • Fix audit logs dropping custom headers when using inline auth (#3076 by @jackyliao123) backported by @phil9909 in https://github.com/openbao/openbao/pull/3114
  • fix: nil-guard d.autopilot before calling GetState (#3054 by @mpldr) backported by @phil9909 in https://github.com/openbao/openbao/pull/3115
  • fix: Fix request handling filtering for the no data case (#3063 by @eklatzer) backported by @phil9909 in https://github.com/openbao/openbao/pull/3116
  • Update vulnerable deps before 2.5.4 by @cipherboy in https://github.com/openbao/openbao/pull/3121
  • Fix cache invalidation memory leak (#3105 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3131
  • Use unique constraints, indices in PostgreSQL storage (#2876 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3132
  • Correctly handle default_rate_limit_exempt_paths_toggle invalidation (#2953 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3134
  • Fix /v1/sys/ forwarding regressions for standby instances (#3006 by @tsaarni) backported by @phil9909 in https://github.com/openbao/openbao/pull/3133
  • Remove legacy cross-namespace lease endpoints (#3152 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3153
  • Prevent errors from creating orphaned tokens (#3150 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3151
  • Add release notes for v2.5.4 by @satoqz in https://github.com/openbao/openbao/pull/3154

Full Changelog: https://github.com/openbao/openbao/compare/v2.5.3...v2.5.4

Breaking Changes

  • Removed legacy lease endpoints: `sys/revoke`, `sys/renew`, `sys/revoke-prefix`, and `sys/revoke-force` due to cross-namespace modifications.
  • Disallowed logical secret engines from creating authentication tokens.

Security Fixes

  • CVE-2026-46358 – core/auth: Fixed audit logs dropping custom headers during inline auth. GHSA-q8cj-789h-vg24.
  • CVE-2026-46405 – core: Prevented hidden default token issuance when auth plugin endpoints return both a `logical.Auth{}` object and an error. GHSA-7j6w-vvw2-5f9c.
  • CVE-2026-45808 – core: Removed legacy cross‑namespace lease endpoints (`sys/revoke`, `sys/renew`, `sys/revoke-prefix`, `sys/revoke-force`). GHSA-v8v8-cm84-m686.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track openbao

Get notified when new releases ship.

Sign up free

About openbao

OpenBao is a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.

All releases →

Related context

Beta — feedback welcome: [email protected]