CVE-2026-39388

[CVE catalog]

Severity

Medium · CVSS 4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Published

Apr 20, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.10% · Oct 25, 2026

A flaw was found in OpenBao, an open source identity-based secrets management system. When renewing tokens using the Certificate authentication method with `disable_binding=true`, the system incorrectly verifies the presented mTLS (mutual Transport Layer Security) certificate. This vulnerability allows an attacker, who possesses a certificate and key signed by the same Certificate Authority (CA) as the original, to renew tokens. Such an action could extend the lifetime of dynamic leases associated with the original token, provided the attacker has knowledge of the original token or its accessor. Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.