OpenBao security fixes in 2.7.2
OpenBao 2.7.2 shipped on 2026-10-26 with fixes for four advisories, three rated high. 2.6.5 carries the same fixes, but OpenBao calls the 2.6 series unsupported and asks users to move to 2.7. None of the four has a CVE id yet.
OpenBao advisories
| Advisory | Severity | Summary | Fixed in |
|---|---|---|---|
GHSA-736f-82w7-hj22 |
High | ACL denies don't hold on AppRole role IDs, Cert auth CRLs, LDAP groups and users, or RADIUS users, because those plugins canonicalise paths on their own. A continuation of GHSA-fg5x-7whg-6c28 |
2.7.2, 2.6.5. LDAP and RADIUS auth plugins 0.2.0 |
GHSA-5pmx-2p74-x478 |
High | A policy that lets someone import Transit keys only at one name can be bypassed by path traversal to import at any key name | 2.7.2, 2.6.5 |
GHSA-q824-44ff-f5j5 |
High | The OIDC provider accepts client_credentials on a public client, so anyone holding that client's client_id gets an ID token |
2.7.2, 2.6.5 |
GHSA-h76r-48x5-36hg |
Medium | SSH identity templates can put * into certificate principals, which OpenSSH reads as a wildcard. 2.7.2 denies it unless allow_wildcards_in_identity_templates is set |
2.7.2, 2.6.5 |
Severity is OpenBao's own rating. Three of the four are marked as original to HashiCorp Vault. OpenBao says exploiting the SSH one usually needs a compromised identity provider.
What to do before you upgrade
The OIDC one has a workaround today. On every public client, set client_credentials=false, and never set both client_type=public and client_credentials=true.
LDAP and RADIUS auth need their own upgrade. OpenBao 2.7.0 moved them out of the main binary into openbao-plugins, so moving the server to 2.7.2 doesn't patch them. The advisory lists plugin version 0.2.0 as the fix for both.
That move to plugins is also the thing to check if you are still on 2.6. In our lab we moved a seeded Vault store to OpenBao 2.7.1. The LDAP and RADIUS auth mounts stayed listed and served nothing, with backend is nil from the API and an error only in the server log (2026-10-12-v1-vault-1.14.8-to-openbao-2.7.1). If staff sign in through LDAP, install the plugin before the first 2.7 node becomes active.
Keycloak
No new Keycloak advisory since our 26.8.1 issue. 26.8.1 is still the newest release.
Written by Ben Hart at MLabs. We rehearse Keycloak and OpenBao upgrades against seeded data in a lab and publish the records. We also run these upgrades for teams who would rather not. Talk to us about your project.