CVE-2026-115356
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Oct 22, 2026
Vendor
unknown
Description
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted.