Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →OpenBao has a critical Raft snapshot vulnerability that can lead to code execution, but it is not a universal unauthenticated entry point. The direct flaw requires write access to privileged snapshot APIs and affects Raft storage deployments; a separate, conditional chain described by ControlPlane shows how an attacker starting with network access could potentially build the privileges needed to exploit it in a specifically configured environment. OpenBao advisories identify versions 2.6.3 and 2.7.0 as patched for these issues.
What the OpenBao code-execution vulnerabilities do
The main issue is CVE-2026-104090, tracked in OpenBao advisory GHSA-j6wc-jpvg-xfxq and published on September 23, 2026. OpenBao rates it Critical with a CVSS v4 score of 9.4. The vulnerable Raft snapshot and force-snapshot APIs can replace stored state, including the plugin catalog. An attacker who can write to those APIs can replace the catalog so that, after OpenBao is unsealed, an attacker-controlled registered plugin can run. The advisory says the plugin can execute without conforming to the configured plugin directory.
As an Amazon Associate I earn from qualifying purchases.
The advisory’s CVSS metrics list a network attack vector, low attack complexity, no attack requirements, high privileges required, and no user interaction. The high-privilege prerequisite matters: the direct vulnerability does not, by itself, establish that an unauthenticated person can call the snapshot endpoint. The advisory explicitly excludes deployments that do not use Raft storage.
Direct exploit versus the conditional route from network access
ControlPlane’s Alex Scheel described a separate, multi-issue scenario in a September 28, 2026 article. It combines four OpenBao advisories to construct a privilege path to the snapshot restore capability. It is a technically described scenario with specific configuration and identity assumptions—not evidence that every OpenBao server is exposed or that exploitation is widespread.
#1 Best Overall
| Issue | Reported severity | What must be true | Role in the scenario |
|---|---|---|---|
| Raft snapshot replacement, CVE-2026-104090; GHSA-j6wc-jpvg-xfxq | CVSS v4 9.4, Critical; OpenBao advisory | Raft storage is in use, and the attacker can write to the relevant snapshot API | Restoring a malicious snapshot can alter the plugin catalog and lead to code execution after unseal |
| ACME SAN validation bypass; GHSA-x8fg-h69x-p28f | CVSS v4 8.2, High; OpenBao advisory | PKI ACME support is enabled and configured; the attacker can validate for an allowed domain | Can allow a certificate to carry additional SAN types, including URI SANs used in ControlPlane’s identity scenario |
| Policy-cache cross-namespace access; GHSA-mjch-vcw3-hhmf | CVSS v4 7.7, as reported by ControlPlane | The relevant policies must be present in OpenBao’s in-memory LRU cache when the token is created and used | Can let crafted policy names reference policies in another namespace, including root |
| ACL denial bypass via non-canonical URLs; GHSA-fg5x-7whg-6c28 | CVSS v4 7.6, as reported by ControlPlane | ACL behavior must combine explicit denies with broader wildcard grants | Can make a specially formatted resource name bypass an explicit deny |
How the described chain reaches snapshot restore
- Start with configured ACME issuance. OpenBao’s ACME issue requires PKI ACME support to be enabled and configured. ControlPlane’s scenario assumes an attacker can validate a domain allowed by that configuration and obtain a certificate with an additional URI SAN.
- Authenticate as a provisioner. The scenario assumes certificate authentication is configured so that the certificate can authenticate as a service provisioner. That provisioner must be allowed to update selected fields in a Certificate Auth role.
- Cross the intended policy boundary. A non-canonical resource name can evade an explicit ACL deny where a broader wildcard grant exists. The constructed path then reaches an administrator role whose
token_policiesfield can be modified by an admin. - Reach root-namespace capability through policy caching. The policy-cache issue can allow a crafted policy name to reference a policy in another namespace, including root, if the named policies are resident in the in-memory LRU cache both when the token is created and when it is used.
- Restore a snapshot and reach the RCE condition. The scenario assumes a root-namespace snapshot-service role capable of restoring Raft. With that capability, an attacker can restore a crafted snapshot and reach the plugin-catalog code-execution path.
This is not a direct unauthenticated request to the snapshot API. Each identity, permission, feature, ACL, cache, and storage condition is part of the route ControlPlane describes.
Which deployments and configurations warrant review
Start by distinguishing the direct snapshot flaw from the additional issues used in the chain. Non-Raft storage rules out the specific snapshot vulnerability described in GHSA-j6wc-jpvg-xfxq, but it does not automatically rule out the ACME, policy-cache, or ACL issues; each has its own applicability conditions.
- Confirm the configured storage backend and identify which principals can call or authorize Raft snapshot and snapshot-force operations.
- Check whether PKI ACME support is enabled, which domains it permits, whether External Account Binding is required, and whether certificates can be used for certificate authentication.
- Review Certificate Auth roles for provisioner access to update role fields, especially where role or token policies can be changed.
- Inspect namespace boundaries, wildcard grants, explicit denies, and roles that can modify
token_policiesor restore snapshots. - Determine whether policy behavior depends on cached policies and whether the affected policy names could be resident in the LRU cache.
Patch versions and interim mitigations
OpenBao’s advisories list versions 2.6.3 and 2.7.0 as patched for the vulnerabilities used in the described chain; ControlPlane recommends upgrading to one of those versions. Treat those as the patched versions identified by these advisories, not as a claim about which release is newest on October 3, 2026. Verify the applicable release and upgrade guidance for your deployment before scheduling the change.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Action | What it addresses | Trade-off or limit |
|---|---|---|
| Upgrade to a patched version identified by the advisories | Fixes the listed vulnerabilities across the direct RCE and chain | Plan and validate the upgrade for the deployment; configuration-only measures are not a substitute for the patch |
Remove plugin_directory to disable plugins |
ControlPlane says this can block the plugin code-execution path | Registered legitimate plugins will also be blocked |
Require ACME External Account Binding (EAB), including with the cited BAO_DISABLE_PUBLIC_ACME setting |
Can require authentication before ACME use and mitigate the ACME portion | It addresses only part of the chain and may be a breaking change if EAB was not already enforced |
Set disable_cache = true |
OpenBao documents this as a workaround for the policy-cache issue | The project warns that disabling the cache significantly affects performance |
| Add grants for every possible exclusion format | May address the ACL issue’s non-canonical-name behavior | Accounting for every possible format may be impractical; it is not a replacement for upgrading |
ControlPlane says the attack sequence has recognizable audit-log signatures and that monitoring may detect it. That is the author’s assessment, not a guarantee that logs or monitoring will catch every attempt. Its September 28 article said a full proof-of-concept chain was available by request and would be released publicly after operators had time to patch; that statement does not establish that public exploit code is available.
Rank #3
Disclosure timeline and what is not established
ControlPlane’s timeline says the snapshot RCE and policy-canonicalization issues were disclosed on September 4, the namespace-traversal report arrived September 8, and the ACME issue was formally disclosed September 17. OpenBao released versions 2.6.3 and 2.7.0 on September 23, when its advisories were published; ControlPlane’s account followed on September 28.
OpenBao’s advisory index, checked October 3, also lists advisories published October 1. Those later entries are separate security updates; their presence does not show that they are part of this four-issue chain. The reviewed sources establish severe technical impact and patched versions, but do not establish an affected-deployment count, victim total, or rate of in-the-wild exploitation. CVSS scores measure severity, not prevalence.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
