Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-gze9-ct59-2qfh
Summary
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
### Impact

In OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the response is includes a `logical.Auth` object in addition to an error message. This results in tokens being created with only the default policy, default TTL, and no entity information, which are hidden by the returned error message. No access to these tokens by the caller occurs and the authentication token is not ever made accessible outside of `sys/raw`. At most this could cause storage usage.

### Patches

This is fixed in OpenBao v2.5.4. 

### Workarounds

Users may set a rate limit quota to limit the creation of these paths. As the path is unauthenticated, it isn't possible to deny access to it.

### Reporter

This was discovered by an anonymous reporter.
Aliases
0
alias CVE-2026-46405
1
alias GHSA-7j6w-vvw2-5f9c
Fixed_packages
0
url pkg:apk/alpine/openbao@2.5.4-r0?arch=aarch64&distroversion=edge&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=aarch64&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=aarch64&distroversion=edge&reponame=community
1
url pkg:apk/alpine/openbao@2.5.4-r0?arch=armhf&distroversion=edge&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=armhf&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=armhf&distroversion=edge&reponame=community
2
url pkg:apk/alpine/openbao@2.5.4-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=armv7&distroversion=edge&reponame=community
3
url pkg:apk/alpine/openbao@2.5.4-r0?arch=loongarch64&distroversion=edge&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=loongarch64&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=loongarch64&distroversion=edge&reponame=community
4
url pkg:apk/alpine/openbao@2.5.4-r0?arch=ppc64le&distroversion=edge&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=ppc64le&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=ppc64le&distroversion=edge&reponame=community
5
url pkg:apk/alpine/openbao@2.5.4-r0?arch=riscv64&distroversion=edge&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=riscv64&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=riscv64&distroversion=edge&reponame=community
6
url pkg:apk/alpine/openbao@2.5.4-r0?arch=s390x&distroversion=edge&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=s390x&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=s390x&distroversion=edge&reponame=community
7
url pkg:apk/alpine/openbao@2.5.4-r0?arch=x86&distroversion=edge&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=x86&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=x86&distroversion=edge&reponame=community
8
url pkg:apk/alpine/openbao@2.5.4-r0?arch=x86_64&distroversion=edge&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=x86_64&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=x86_64&distroversion=edge&reponame=community
9
url pkg:apk/alpine/openbao@2.5.4-r0?arch=aarch64&distroversion=v3.23&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=aarch64&distroversion=v3.23&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=aarch64&distroversion=v3.23&reponame=community
10
url pkg:apk/alpine/openbao@2.5.4-r0?arch=armhf&distroversion=v3.23&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=armhf&distroversion=v3.23&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=armhf&distroversion=v3.23&reponame=community
11
url pkg:apk/alpine/openbao@2.5.4-r0?arch=armv7&distroversion=v3.23&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=armv7&distroversion=v3.23&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=armv7&distroversion=v3.23&reponame=community
12
url pkg:apk/alpine/openbao@2.5.4-r0?arch=loongarch64&distroversion=v3.23&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=loongarch64&distroversion=v3.23&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=loongarch64&distroversion=v3.23&reponame=community
13
url pkg:apk/alpine/openbao@2.5.4-r0?arch=ppc64le&distroversion=v3.23&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=ppc64le&distroversion=v3.23&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=ppc64le&distroversion=v3.23&reponame=community
14
url pkg:apk/alpine/openbao@2.5.4-r0?arch=riscv64&distroversion=v3.23&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=riscv64&distroversion=v3.23&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=riscv64&distroversion=v3.23&reponame=community
15
url pkg:apk/alpine/openbao@2.5.4-r0?arch=s390x&distroversion=v3.23&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=s390x&distroversion=v3.23&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=s390x&distroversion=v3.23&reponame=community
16
url pkg:apk/alpine/openbao@2.5.4-r0?arch=x86&distroversion=v3.23&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=x86&distroversion=v3.23&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=x86&distroversion=v3.23&reponame=community
17
url pkg:apk/alpine/openbao@2.5.4-r0?arch=x86_64&distroversion=v3.23&reponame=community
purl pkg:apk/alpine/openbao@2.5.4-r0?arch=x86_64&distroversion=v3.23&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/openbao@2.5.4-r0%3Farch=x86_64&distroversion=v3.23&reponame=community
18
url pkg:golang/github.com/openbao/openbao@2.5.4
purl pkg:golang/github.com/openbao/openbao@2.5.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:golang/github.com/openbao/openbao@2.5.4
Affected_packages
References
0
reference_url https://github.com/openbao/openbao
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/openbao/openbao
1
reference_url https://github.com/openbao/openbao/commit/0d82e0a5a3b6a93e8087bcbaf0b11326c12d4f4d
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/openbao/openbao/commit/0d82e0a5a3b6a93e8087bcbaf0b11326c12d4f4d
2
reference_url https://github.com/openbao/openbao/pull/3150
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/openbao/openbao/pull/3150
3
reference_url https://github.com/openbao/openbao/releases/tag/v2.5.4
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/openbao/openbao/releases/tag/v2.5.4
4
reference_url https://github.com/openbao/openbao/security/advisories/GHSA-7j6w-vvw2-5f9c
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/openbao/openbao/security/advisories/GHSA-7j6w-vvw2-5f9c
Weaknesses
0
cwe_id 770
name Allocation of Resources Without Limits or Throttling
description The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Exploits
Severity_range_score4.0 - 6.9
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-gze9-ct59-2qfh