Community fork of Vault under an open-source licence
Linux Foundation project that forked HashiCorp Vault's last MPL-licensed code to keep an open-source secrets manager with a compatible API.
OpenBao manages, stores and distributes secrets, certificates and keys, with the same model as Vault: auth methods, policies, secrets engines and audit logging. It began as a fork of Vault 1.14, the last version under the MPL 2.0 licence.
The project is governed in the open under the Linux Foundation and keeps API compatibility with Vault for most use cases while adding its own features.
MPL-2.0 · Mozilla Public License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: MPL-2.0.
50 published advisories for OpenBao in GitHub repository advisories and OSV.dev; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.
GHSA-gf3j-hm38-jhh5medium2026-10-01
OpenBao's Kubernetes Auth Method Allows Renewal on Revoked Tokens
GHSA-q74w-hv5x-6hxflow2026-10-01
Improper Audit Logging of OpenBao's Root Token Generation and Unauthenticated Rekey Operations
GHSA-5v22-543h-wg96medium2026-10-01
OpenBao's Request Parsing Allow Bypassing Role-Based Rate Limit Quotas
GHSA-7m59-mp95-w6phlow2026-10-01
OpenBao's AppRole SecretID is Usable Past Expiration
GHSA-3237-j65r-m5rplow2026-10-01
OpenBao's Sanitized Configuration Discloses ACME EAB MAC Key
GHSA-8xxq-mq9m-xmhwlow2026-09-23
OpenBao Plugins May Leak Malformed TypeKVPair and TypeHeader Parameters in Audit Log
GHSA-x8fg-h69x-p28fCVE-2026-104092high2026-09-23
OpenBao's PKI ACME Issues Certificate With Unvalidated SANs
GHSA-2cjw-94fw-wqjxmedium2026-09-23
Open Redirect in OpenBao's OIDC UI
GHSA-hr5j-3j78-4vh2low2026-09-23
Denied Wildcard Allows Limited ACL Bypass in OpenBao
GHSA-8gmq-wv9h-fcwplow2026-09-23
OpenBao's Agent/Proxy Allows Exiting Without Required Header
GHSA-mjch-vcw3-hhmfhigh2026-09-23
OpenBao's Policy Cache Allows Incorrect Authorization via Namespace Traversal
GHSA-j6wc-jpvg-xfxqCVE-2026-104090critical2026-09-23
Remote Code Execution via `sys/storage/raft/snapshot-force` Plugin Catalog Replacement in OpenBao
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Secrets, certificates and access management platform
Open-core platform to manage application secrets and environment variables across teams and infrastructure, with SDKs, a CLI and secret scanning.
Identity and access management for apps and services
Identity provider with single sign-on, OpenID Connect, OAuth 2.0 and SAML, user federation, MFA and fine-grained authorisation. A CNCF project.
Secrets management and encryption as a service
Secrets manager that stores and issues credentials, certificates and keys, with dynamic secrets, encryption as a service and detailed audit logs.
Self-hosted identity provider
Identity provider supporting OIDC, OAuth 2.0, SAML, LDAP, RADIUS and a proxy provider, with flow-based customisation of every login step.
Offline, cross-platform password manager
Community port of KeePass for Windows, macOS and Linux that stores passwords in an encrypted KDBX database file you control.
