Nixpkgs security tracker

Untriaged

Permalink CVE-2026-46358

5.4 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): High (H)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.

References

https://github.com/openbao/openbao/security/advisories/GHSA-q8cj-789h-vg24 x_refsource_CONFIRM
https://github.com/openbao/openbao/issues/3074 x_refsource_MISC
https://github.com/openbao/openbao/pull/3076 x_refsource_MISC
https://github.com/openbao/openbao/commit/131c6966af4dfb4e1906703436eecdb8f2a3e9df x_refsource_MISC
https://github.com/openbao/openbao/releases/tag/v2.5.4 x_refsource_MISC

Affected products

openbao

==< 2.5.4

Matching in nixpkgs

pkgs.openbao

Open source, community-driven fork of Vault managed by the Linux Foundation

nixos-unstable -
- nixos-unstable-small 2.7.0
nixos-26.05 -
- nixos-26.05-small 2.6.2

pkgs.openbaoPlugins.kms-aws

OpenBao KMS plugin for Auto Unseal via AWS

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.kms-gcp

OpenBao KMS plugin for Auto Unseal via Google Cloud

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.kms-oci

OpenBao KMS plugin for Auto Unseal via Oracle Cloud

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.auth-aws

OpenBao auth plugin to authenticate using AWS IAM credentials

nixos-unstable -
- nixos-unstable-small 0.1.1

pkgs.openbaoPlugins.auth-gcp

OpenBao auth plugin to authenticate using Google Cloud Platform credentials

nixos-unstable -
- nixos-unstable-small 0.22.0

pkgs.openbaoPlugins.kms-azure

OpenBao KMS plugin for Auto Unseal via Azure

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.auth-azure

OpenBao auth plugin to authenticate using Microsoft Azure credentials

nixos-unstable -
- nixos-unstable-small 0.23.0

pkgs.openbaoPlugins.kms-pkcs11

OpenBao KMS plugin for Auto Unseal and External Keys via PKCS#11

nixos-unstable -
- nixos-unstable-small 0.2.1

pkgs.openbaoPlugins.auth-github

OpenBao auth plugin to authenticate using GitHub credentials

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.secrets-aws

OpenBao secrets plugin to generate AWS access credentials based on IAM policies

nixos-unstable -
- nixos-unstable-small 0.3.1

pkgs.openbaoPlugins.secrets-gcp

OpenBao secrets plugin to generate GCP service account keys and OAuth tokens based on IAM policies

nixos-unstable -
- nixos-unstable-small 0.23.1

pkgs.openbaoPlugins.kms-alicloud

OpenBao KMS plugin for Auto Unseal via AliCloud

nixos-unstable -
- nixos-unstable-small 0.1.1

pkgs.openbaoPlugins.kms-ovhcloud

OpenBao KMS plugin for Auto Unseal via OVHcloud

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.secrets-azure

OpenBao secrets plugin to generate Azure service principals with role and group assignments

nixos-unstable -
- nixos-unstable-small 0.23.0

pkgs.openbaoPlugins.secrets-nomad

OpenBao secrets plugin to generate Nomad ACL tokens

nixos-unstable -
- nixos-unstable-small 0.1.6

pkgs.openbaoPlugins.secrets-consul

OpenBao secrets plugin to generate Consul ACL tokens

nixos-unstable -
- nixos-unstable-small 0.1.1

pkgs.openbaoPlugins.secrets-gcpkms

OpenBao secrets plugin to encrypt data and manage keys via GCP KMS

nixos-unstable -
- nixos-unstable-small 0.21.0

pkgs.openbaoPlugins.database-mongodb

OpenBao database plugin to generate MongoDB database credentials

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.kms-tcloudpublic

OpenBao KMS plugin for Auto Unseal via T Cloud Public

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.secrets-oauthapp

OpenBao secrets plugin for OAuth 2.0 supporting a variety of grant types

nixos-unstable -
- nixos-unstable-small 3.4.0

Package maintainers

@emilylange Emily Lange <nix@emilylange.de>
@brianmay Brian May <brian@linuxpenguins.xyz>
@Kranzes Ilan Joselevich <personal@ilanjoselevich.com>

Untriaged

Permalink CVE-2026-45808

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.

References

https://github.com/openbao/openbao/security/advisories/GHSA-v8v8-cm84-m686 x_refsource_CONFIRM
https://github.com/openbao/openbao/pull/3152 x_refsource_MISC
https://github.com/openbao/openbao/commit/c0495646b41cea0e3f5a1030132e9cf5c2375b5c x_refsource_MISC
https://github.com/openbao/openbao/releases/tag/v2.5.4 x_refsource_MISC

Affected products

openbao

==< 2.5.4

Matching in nixpkgs

pkgs.openbao

Open source, community-driven fork of Vault managed by the Linux Foundation

nixos-unstable -
- nixos-unstable-small 2.7.0
nixos-26.05 -
- nixos-26.05-small 2.6.2

pkgs.openbaoPlugins.kms-aws

OpenBao KMS plugin for Auto Unseal via AWS

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.kms-gcp

OpenBao KMS plugin for Auto Unseal via Google Cloud

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.kms-oci

OpenBao KMS plugin for Auto Unseal via Oracle Cloud

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.auth-aws

OpenBao auth plugin to authenticate using AWS IAM credentials

nixos-unstable -
- nixos-unstable-small 0.1.1

pkgs.openbaoPlugins.auth-gcp

OpenBao auth plugin to authenticate using Google Cloud Platform credentials

nixos-unstable -
- nixos-unstable-small 0.22.0

pkgs.openbaoPlugins.kms-azure

OpenBao KMS plugin for Auto Unseal via Azure

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.auth-azure

OpenBao auth plugin to authenticate using Microsoft Azure credentials

nixos-unstable -
- nixos-unstable-small 0.23.0

pkgs.openbaoPlugins.kms-pkcs11

OpenBao KMS plugin for Auto Unseal and External Keys via PKCS#11

nixos-unstable -
- nixos-unstable-small 0.2.1

pkgs.openbaoPlugins.auth-github

OpenBao auth plugin to authenticate using GitHub credentials

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.secrets-aws

OpenBao secrets plugin to generate AWS access credentials based on IAM policies

nixos-unstable -
- nixos-unstable-small 0.3.1

pkgs.openbaoPlugins.secrets-gcp

OpenBao secrets plugin to generate GCP service account keys and OAuth tokens based on IAM policies

nixos-unstable -
- nixos-unstable-small 0.23.1

pkgs.openbaoPlugins.kms-alicloud

OpenBao KMS plugin for Auto Unseal via AliCloud

nixos-unstable -
- nixos-unstable-small 0.1.1

pkgs.openbaoPlugins.kms-ovhcloud

OpenBao KMS plugin for Auto Unseal via OVHcloud

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.secrets-azure

OpenBao secrets plugin to generate Azure service principals with role and group assignments

nixos-unstable -
- nixos-unstable-small 0.23.0

pkgs.openbaoPlugins.secrets-nomad

OpenBao secrets plugin to generate Nomad ACL tokens

nixos-unstable -
- nixos-unstable-small 0.1.6

pkgs.openbaoPlugins.secrets-consul

OpenBao secrets plugin to generate Consul ACL tokens

nixos-unstable -
- nixos-unstable-small 0.1.1

pkgs.openbaoPlugins.secrets-gcpkms

OpenBao secrets plugin to encrypt data and manage keys via GCP KMS

nixos-unstable -
- nixos-unstable-small 0.21.0

pkgs.openbaoPlugins.database-mongodb

OpenBao database plugin to generate MongoDB database credentials

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.kms-tcloudpublic

OpenBao KMS plugin for Auto Unseal via T Cloud Public

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.secrets-oauthapp

OpenBao secrets plugin for OAuth 2.0 supporting a variety of grant types

nixos-unstable -
- nixos-unstable-small 3.4.0

Package maintainers

@emilylange Emily Lange <nix@emilylange.de>
@brianmay Brian May <brian@linuxpenguins.xyz>
@Kranzes Ilan Joselevich <personal@ilanjoselevich.com>

Untriaged

Permalink CVE-2026-42186

2.3 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Attack Requirement (AT): Present (P)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 4 months, 1 week ago Activity log

Created suggestion 4 months, 1 week ago

OpenBao's Namespace Deletion May Not Delete Data Properly

OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrelated storage entries around. This vulnerability is fixed in 2.5.3.

References

https://github.com/openbao/openbao/security/advisories/GHSA-vv66-6rp4-wr4f x_refsource_CONFIRM
https://github.com/openbao/openbao/commit/6d2e0506e2b41be0eaa6643bf7b4efc9a2c09445 x_refsource_MISC
https://github.com/openbao/openbao/releases/tag/v2.5.3 x_refsource_MISC

Affected products

openbao

==< 2.5.3

Matching in nixpkgs

pkgs.openbao

Open source, community-driven fork of Vault managed by the Linux Foundation

nixos-unstable -
- nixos-unstable-small 2.7.0
nixos-26.05 -
- nixos-26.05-small 2.6.2

pkgs.openbaoPlugins.kms-aws

OpenBao KMS plugin for Auto Unseal via AWS

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.kms-gcp

OpenBao KMS plugin for Auto Unseal via Google Cloud

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.kms-oci

OpenBao KMS plugin for Auto Unseal via Oracle Cloud

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.auth-aws

OpenBao auth plugin to authenticate using AWS IAM credentials

nixos-unstable -
- nixos-unstable-small 0.1.1

pkgs.openbaoPlugins.auth-gcp

OpenBao auth plugin to authenticate using Google Cloud Platform credentials

nixos-unstable -
- nixos-unstable-small 0.22.0

pkgs.openbaoPlugins.kms-azure

OpenBao KMS plugin for Auto Unseal via Azure

nixos-unstable -
- nixos-unstable-small 0.1.0

pkgs.openbaoPlugins.auth-azure

OpenBao auth plugin to authenticate using Microsoft Azure credentials

nixos-unstable -
- nixos-unstable-small 0.23.0

pkgs.openbaoPlugins.kms-pkcs11

OpenBao KMS plugin for Auto Unseal and External Keys via PKCS#11

nixos-unstable -
- nixos-unstable-small 0.2.1

pkgs.openbaoPlugins.auth-github

OpenBao auth plugin to authenticate using GitHub credentials

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.secrets-aws

OpenBao secrets plugin to generate AWS access credentials based on IAM policies

nixos-unstable -
- nixos-unstable-small 0.3.1

pkgs.openbaoPlugins.secrets-gcp

OpenBao secrets plugin to generate GCP service account keys and OAuth tokens based on IAM policies

nixos-unstable -
- nixos-unstable-small 0.23.1

pkgs.openbaoPlugins.kms-alicloud

OpenBao KMS plugin for Auto Unseal via AliCloud

nixos-unstable -
- nixos-unstable-small 0.1.1

pkgs.openbaoPlugins.kms-ovhcloud

OpenBao KMS plugin for Auto Unseal via OVHcloud

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.secrets-azure

OpenBao secrets plugin to generate Azure service principals with role and group assignments

nixos-unstable -
- nixos-unstable-small 0.23.0

pkgs.openbaoPlugins.secrets-nomad

OpenBao secrets plugin to generate Nomad ACL tokens

nixos-unstable -
- nixos-unstable-small 0.1.6

pkgs.openbaoPlugins.secrets-consul

OpenBao secrets plugin to generate Consul ACL tokens

nixos-unstable -
- nixos-unstable-small 0.1.1

pkgs.openbaoPlugins.secrets-gcpkms

OpenBao secrets plugin to encrypt data and manage keys via GCP KMS

nixos-unstable -
- nixos-unstable-small 0.21.0

pkgs.openbaoPlugins.database-mongodb

OpenBao database plugin to generate MongoDB database credentials

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.kms-tcloudpublic

OpenBao KMS plugin for Auto Unseal via T Cloud Public

nixos-unstable -
- nixos-unstable-small 0.0.1

pkgs.openbaoPlugins.secrets-oauthapp

OpenBao secrets plugin for OAuth 2.0 supporting a variety of grant types

nixos-unstable -
- nixos-unstable-small 3.4.0

Package maintainers

@emilylange Emily Lange <nix@emilylange.de>
@brianmay Brian May <brian@linuxpenguins.xyz>
@Kranzes Ilan Joselevich <personal@ilanjoselevich.com>

Untriaged

Permalink CVE-2026-40264

created 5 months ago Activity log

Created suggestion 5 months ago

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.