OpenBao Agent leaked secrets to stdout in error conditions

OpenBao has disclosed a flaw in OpenBao Agent that caused secrets to be written to standard output during certain error conditions. The advisory, GHSA-444v-8vxr-p36h, was published on 22 September 2026 and carries the identifier CVE-2026-77285. It affects the OpenBao Go packages and is fixed in OpenBao v2.6.0 GA, according to the advisory.

OpenBao Agent is the client-side helper process that fetches secrets on behalf of an application. In exec rendering mode, the agent launches a child process and passes secrets to it through environment variables defined in an env_template block. That design is meant to keep credentials out of files and off the command line, so they exist only in the memory of the process that needs them.

According to the advisory, that containment broke under error conditions. In exec rendering mode, the agent would incorrectly write the secrets specified in env_template to stdout. The advisory says this primarily happens when num_retries is met, that is, when the agent has exhausted the number of attempts it is configured to make before giving up.

The practical concern with writing secrets to stdout is where that output ends up. Agent processes are commonly supervised by init systems, container runtimes or orchestration platforms, all of which capture stdout and forward it to logs. Logs are then often shipped to central collectors and retained. The advisory does not describe any specific exposure path or any reports of exploitation, and does not state how long the behaviour had been present.

OpenBao says the vulnerability is original to Vault, the project from which OpenBao was forked, rather than something introduced by OpenBao's own changes. It was reported through the OpenBao security mailing list. The advisory does not name the reporter.

The only remedy given in the advisory is to upgrade. OpenBao states that the issue is addressed in OpenBao v2.6.0 GA. The advisory lists no workaround, no configuration change that avoids the behaviour, and no partial mitigation for operators who cannot upgrade immediately.

For teams running the affected versions, the advisory's description points to two pieces of follow-up work beyond patching. The first is establishing whether any agent instance using exec rendering mode actually hit its retry limit, since that is the condition the advisory identifies as the main trigger. The second is checking whether captured stdout from those processes was retained anywhere, and treating any secrets that appear there as exposed. The advisory itself does not give guidance on rotation.

The disclosure is a reminder that secrets-delivery tooling sits on the same failure paths as the applications it serves. Error handling is where credentials are most likely to escape the channel built for them, because the code that runs when everything works is rarely the code that prints diagnostics.