OpenBao Agent writes secrets to stdout in error conditions

OpenBao Agent's exec rendering mode incorrectly writes secrets to stdout during certain error conditions, particularly when num_retries is met. The vulnerability was inherited from Vault and has been patched in version 2.6.0.

Disclosed 22 September 2026 · Record updated 1 October 2026

Impact

Secrets specified in env_template are exposed to stdout during error conditions, potentially exposing sensitive information to unauthorized parties with access to process output or logs.

Our coverage

A vault door swings open as a frustrated mechanic, unable to restart a failing machine, watches blueprints with hidden codes scatter across the factory floor in the wind.

Vulnerabilities

OpenBao Agent leaked secrets to stdout in error conditions

An advisory published on 22 September 2026 says the secrets manager's exec mode printed templated credentials when retries ran out; a fix ships in v2.6.0.

22 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-444v-8vxr-p36h