OpenBao 2.7.2 shipped on 26 October 2026 with fixes for four advisories. OpenBao rates three of them high and one medium. For two of them, upgrading the server is not the whole job.
2.6.5 carries the same fixes. OpenBao calls the 2.6 series unsupported and asks users to move to 2.7, so read the plugin section below before you do.
The four advisories
| Advisory | Severity | What breaks | Fixed in |
|---|---|---|---|
| GHSA-736f-82w7-hj22 | High | ACL denies don't hold on AppRole role IDs, Cert auth CRLs, LDAP groups and users, or RADIUS users, because those plugins canonicalise paths on their own | 2.7.2, 2.6.5, LDAP and RADIUS plugins 0.2.0 |
| GHSA-5pmx-2p74-x478 | High | A policy that allows Transit key import at one name can be bypassed by path traversal to import at any name | 2.7.2, 2.6.5 |
| GHSA-q824-44ff-f5j5 | High | The OIDC provider accepts client_credentials on a public client, so anyone holding its client_id gets an ID token | 2.7.2, 2.6.5 |
| GHSA-h76r-48x5-36hg | Medium | SSH identity templates can put * into certificate principals, which OpenSSH reads as a wildcard | 2.7.2, 2.6.5 |
Severity is OpenBao's own rating. Three of the four are marked as original to HashiCorp Vault. None had a CVE id when this was written.
The OIDC fix has a workaround you can apply today
If you run OpenBao as an OIDC provider, list your clients and look at two fields. On every client with client_type=public, set client_credentials=false. A public client has no secret, so a token issued on the client credentials grant goes to anyone who knows the client ID. Client IDs are not secret. They sit in browser code and redirect URLs.
This change is safe before the upgrade, and it closes the hole on any version.
LDAP and RADIUS auth need their own upgrade
OpenBao 2.7.0 moved the LDAP and RADIUS auth methods out of the main binary into openbao-plugins. So upgrading the server to 2.7.2 does not patch them. The advisory names plugin version 0.2.0 as the fix for both.
If you are still on 2.6, that move is the bigger risk. In our lab we moved a seeded Vault store to OpenBao 2.7.1. The LDAP and RADIUS auth mounts stayed listed and served nothing. The API answered backend is nil, and the only other sign was an error in the server log. If staff sign in through LDAP, install the plugin before the first 2.7 node becomes active.
The ACL fix changes what your deny rules mean
GHSA-736f-82w7-hj22 continues an earlier advisory, GHSA-fg5x-7whg-6c28. The plugins named above canonicalised paths implicitly, and OpenBao says that left ACL denies on those paths unable to work properly.
After the upgrade, those denies hold as written. That is the point of the fix, and it can also surface clients that only worked because a deny was being skipped. Test the AppRole and Cert auth flows your automation uses before the change reaches production.
Transit and SSH are policy reviews
The Transit fix matters if a policy pins key import to one name with name in required_parameters and treats that as a boundary. Before 2.7.2 that boundary did not hold. Search your policies for Transit import paths and check who holds them.
The SSH fix is narrower. OpenBao says exploiting it usually needs a compromised identity provider. 2.7.2 now refuses * from an identity template unless allow_wildcards_in_identity_templates is set. If a role relied on that, it will start failing after the upgrade, which is the safer way round.
The order we'd use
Set client_credentials=false on public OIDC clients now. Install the 0.2.0 LDAP and RADIUS plugins. Then move the servers to 2.7.2 and test AppRole, Cert auth and SSH signing straight after.
We rehearse OpenBao and Vault upgrades against seeded data and publish the records. If you'd like a second pair of hands on yours, talk to us.
