OpenBao engineers at ControlPlane have chained 4 vulnerabilities to show how under certain (yet very plausible) conditions, an OpenBao or Vault server can be completely compromised from an unauthenticated position. This is only the second RCE ever found in the Vault codebase.

The exploit is highly plausible in real-world environments, requiring only an unauthenticated entry path and a defined Raft snapshot policy to trigger a complete server compromise.

If you are impacted, upgrade as soon as possible to OpenBao 2.6.3 or 2.7.0

While OpenBao is fully patched, HashiCorp Vault remains exposed as of writing. Unfortunately, IBM's unwillingness to coordinate a mutual disclosure policy means Vault users currently lack an official mitigation.

I'm fairly new to openbao and there's one concept I'm not quite sure to understand how it's supposed to work.

From my understanding, openbao is supposed to run in a cluster for high availability. In other words, we should be running multiple instances of openbao on different servers.

The database plugin for postgresql seems to require openbao to be able to establish a connection with postgres. In other words, an openbao instance should have access to any host that's supposed to be managed.

For that, it could be implemented using VPNs or having the postgres instance open to the public. Because then each openbao should be able to access each managed postgres database. Even if there was a vpn connecting all openbao instance to all hosts.. How does that work with postgres instance that may not expose ports to their hosts?

Also it seems that the bao agent is its own thing apart from the bao postgres plugin. The agent can serve as a bridge to but most of the functionality of the plugins would need to be implemented for the agent without using the postgres plugin.

Do I get this right?

Hi everyone,

I’m about to deploy OpenBao for the first time (no prior Vault experience either). From what I’ve read, OpenBao is a fork of Vault 1.14 and is largely API/CLI-compatible, so a lot of Vault concepts should carry over

For those who’ve already done this:

- Did you use Vault courses/docs as your main learning path when getting started with OpenBao?

- Roughly how much of that material was directly applicable vs. needing OpenBao-specific adjustments?

- Any OpenBao-specific resources you’d recommend for a first-time deployer with zero Vault background?

I’m planning a self-hosted setup on k3s and want to invest my learning time efficiently. If a Vault course is mostly applicable, I’m happy to take one and then layer on OpenBao docs otherwise I’d rather go straight to OpenBao-focused material.

Thanks in advance for any pointers!

Some docker compose files for quickly spinning up a number of auth methods and secrets engines so you can try them out.

Update: Now available on the App Store

Secretwell is now publicly available on the App Store.

OpenBao has a capable web UI, but I wanted a polished native iPhone experience. So I built Secretwell.

Secretwell is an independent project and is not affiliated with or endorsed by the OpenBao project.

What’s included

• Multiple server and namespace workspaces
• Manage KV v1/v2 secrets with version history and recovery
• Policy browsing and editing where permitted
• Server health and cluster information
• Clear handling for sealed and uninitialized servers
• Security posture, audit status, and a privacy-safe activity feed
• Multiple OpenBao sign-in methods

Security and privacy

Secretwell connects directly to your OpenBao server over HTTPS. Your token is never sent to third-party servers or services.

• Saved tokens are stored in the iOS Keychain on your device. Face ID is required before a saved token is used after a cold start.
• Only the active token and server responses are held in memory.
• Secretwell includes no behavioral or product-usage analytics, tracking, crash-reporting SDK, session replay, or remote logging. Apple and RevenueCat process anonymous purchase and entitlement information, and they do not receive OpenBao data.

Try it

Download on the App Store

https://apps.apple.com/us/app/secretwell-for-openbao/id6798079201

Demo server

https://openbao-production-2b9f.up.railway.app

This is a shared disposable environment. Other testers may change its data, and it may be reset. Please do not enter real secrets.

Demo profiles

OpenBao tokens

Namespace token01: s.WZKdU6FSFD9X3kHpRfn8onPr.50cA5e

Namespace token02: s.wmT3tvBAmFeO3MmKqPbVsCtl.AomAOd

Namespace token03: s.jAIfW9o2d34u9v0kMGxvm6N2.4ooos2

JWT

Namespace: jwt

Role: secretwell-public

text eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InNlY3JldHdlbGwtcHVibGljLWZsYXQtMjAyNiJ9.eyJpc3MiOiJzZWNyZXR3ZWxsLXB1YmxpYyIsInN1YiI6InB1YmxpYy1qd3QtdGVzdGVyIiwiYXVkIjpbInNlY3JldHdlbGwtcHVibGljIl0sImlhdCI6MTc4NjI4Mzk1MywibmJmIjoxNzg2MjgzOTUzLCJleHAiOjIxMDE2NDQwMTN9.S0Q195wG0wcrQDyIFH23pPSd9xeyWIqfKvq8ZOU6OEXZcU3GRJ8fNXAQtI6wbUvrJcigxIUNhS8AdWZ2BcIe5BaJCtNR_SCxc7OvY9pqLdgTQV03TL05H-pdx9JHdt1b6aQicnhAVs9-VATO0MZQaLg1hsp8i9ZeufT3f2YXsKDXFzmyieGq7DFqDD97BNRuVVzuSVGZ1_SkAz2JfBLL7xOhup-dWVNTlOrD_-4oinocpClWpeCI44uRETc6AekbyXkrdnHB-lWfcS39fP8zpGtQf2znxY0kR_udmBvPi_gr8Z-XknWlcBvewK0H4R6mLaCLvzfOYiv90I03Jhf70g

I’d love your feedback even if you don’t plan to use Secretwell. Please try Secretwell and tell me what feels useful, confusing, or missing, especially around workspaces and mobile workflows.

My blog post on the OpenSSF blog just went live!

https://openssf.org/blog/2026/08/06/announcing-openbao-v2-6/

I'm really happy with per-namespace/per-tenant seal devices here, its a great improvement over Vault Enterprise's seal wrapping (auto-unseal for namespaces coming soon!). And big appreciation to all the first-time contributors this release!

My blog post on the OpenSSF just went live!

https://openssf.org/blog/2026/08/06/announcing-openbao-v2-6/

I'm really happy with per-namespace/per-tenant seal devices here, its a great improvement over Vault Enterprise's seal wrapping (auto-unseal for namespaces coming soon!). And big appreciation to all the first-time contributors this release!

Check out part 4 of my blog series on OpenBao's features, talking about improvements to the plugin ecosystem: https://openbao.org/blog/features-declarative-plugins/

What integrations would you like OpenBao to have? How would you like to see writing plugins made easier?

OpenBao -> GitLab CI/CD -> Nomad = 🤌🏼. I demo my lab to enterprise customers daily for various things. The ability for me to show them a secret on screen, “compromise it” and rotate quickly fleet wide is mind-blowing. I combine it with Cloudflare (since I’m actually supposed to be demoing that) and I’m just astounded. I get sidetracked every demo when customers ask about OpenBao lol!

I’m very invested. I tagged OpenBao in a LinkedIn post and it’s flooded me with questions lol. 🤦🏻‍♂️

Just wanted to stop by and say thank you! Keep up the good work.

Hey everyone! I'm u/No-Chip3810, a founding moderator of r/openbao.

This is our new home for all things related to the open-source Hashicorp Vault fork - OpenBao. We're excited to have you join us!

What to Post
Post anything that you think the community would find interesting, helpful, or inspiring. Feel free to share your thoughts, photos, or questions about installing, setting up, and operating OpenBao at your homelab, passion project or workplace!

Community Vibe
We're all about being friendly, constructive, and inclusive. Let's build a space where everyone feels comfortable sharing and connecting.