CVE-2026-77285: OpenBao Agent Writes Secrets to Stdout
During certain error conditions, OpenBao Agent’s exec rendering mode will incorrectly write secrets specified in env_template to stdout. This primarily happens when num_retries is met.
This vulnerability is original to Vault and was reported via the OpenBao security mailing list.
References
- github.com/advisories/GHSA-444v-8vxr-p36h
- github.com/openbao/openbao/commit/90272575e5f58b3883fbb0ccb2238e9285722d1a
- github.com/openbao/openbao/commit/ee3aa4aff72c5176cf02af21eac7158899080878
- github.com/openbao/openbao/pull/3494
- github.com/openbao/openbao/pull/3495
- github.com/openbao/openbao/releases/tag/v2.6.0
- github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h
- nvd.nist.gov/vuln/detail/CVE-2026-77285
Code Behaviors & Features
Detect and mitigate CVE-2026-77285 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →