OpenBao

ControlPlane published a detailed exploit chain chaining four OpenBao flaws into an unauthenticated remote code execution attack. The attack forges a SPIFFE provisioner certificate via ACME URI SAN bypass, hijacks admin roles through case-insensitive ACL paths, crosses namespaces to restore malicious Raft snapshots, and executes arbitrary pre-existing binaries. Vault Community Edition remains unpatched after IBM declined mutual disclosure.