OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-39388 · CVE overview and exploitation status

EUVD-2026-24029

GHSA-7ccv-rp6m-rffr

BIT-openbao-2026-39388

GO-2026-5213

cve-program · CVE-2026-39388

• https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr

euvd · EUVD-2026-24029

• https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr

nvd · CVE-2026-39388

• https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr

osv · GHSA-7ccv-rp6m-rffr

• https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr
• https://nvd.nist.gov/vuln/detail/CVE-2026-39388
• https://github.com/openbao/openbao/pull/2932
• https://github.com/openbao/openbao/commit/9ab7a066826cc544c30e8b203f8f472076f366e1
• https://github.com/openbao/openbao
• https://github.com/openbao/openbao/releases/tag/v2.5.3

osv · GO-2026-5213

• https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr
• https://nvd.nist.gov/vuln/detail/CVE-2026-39388
• https://github.com/openbao/openbao/commit/9ab7a066826cc544c30e8b203f8f472076f366e1
• https://github.com/openbao/openbao/pull/2932
• https://github.com/openbao/openbao/releases/tag/v2.5.3

• OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current req… · Advisory content revised · 15 Nov 2026