OpenBao Certificate Authentication Token Renewal Vulnerability

A vulnerability exists in OpenBao's Certificate authentication method prior to version 2.5.3. When token renewal is requested with 'disable_binding=true', the system incorrectly verifies the presented mTLS certificate, allowing an attacker to renew tokens using a sibling certificate and key signed by the same CA, without matching the original certificate or role. This could enable the attacker to extend the lifetime of dynamic leases associated with the original token, requiring knowledge of the original token or its accessor.

Impact

Exploitation allows for unauthorized token renewal, extending the lifetime of dynamic leases associated with the original token, which could be used to authenticate within a similar scope.

Remediation

Users are advised to update to OpenBao version 2.5.3 and ensure that privileged roles are tightly scoped to single certificates.