Critical RCE Alert: Full takeover of HashiCorp Vault and OpenBao
Upgrade to OpenBao versions 2.6.3 or 2.7.0 to mitigate risks. Vault remains vulnerable.
Engineers at OpenBao have demonstrated how four vulnerabilities can lead to a complete compromise of an OpenBao or Vault server from an unauthenticated position. This marks the second RCE ever discovered in the Vault codebase. The exploit is feasible in real-world scenarios, requiring only an unauthenticated entry point and a defined Raft snapshot policy.
This synthesis was produced from its source by AI; there is no human editor or manual review step. How we work