CVE-2026-39396
OpenBao is an open source identity-based secrets management system.
Published Apr 21, 2026 · updated Jun 17, 2026 · openbao openbao
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file. The SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature. Version 2.5.3 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 21, 2026 · NIST NVD
Detected
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing
Jun 17, 2026 · NIST NVD
Updated
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing
Affected
- cpe openbao/openbaoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-39396
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-39396
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via with no upper bound on the nu
nvd.nist.gov