Penetration Tester: 2026-09-30

1. A Realistic Code Execution Exploit Chain in OpenBao and Vault

   ControlPlane, 2026-09-28. Read, 12 min.

   ControlPlane, working with the OpenBao community, describes an exploit chain from unauthenticated access to full remote code execution built from four vulnerabilities that OpenBao v2.6.3 and v2.7.0 already fixed on September 23. It says the chain was built from exploits it knows affect Vault Community Edition and reasonably suspects affect Vault Enterprise, and that the post will be updated when HashiCorp Vault remediates them.

   Why it matters for this role: Flag Vault Community Edition servers in authorized test reports as affected by this chain until HashiCorp ships a fix, as ControlPlane says Vault had not remediated it at publication.

Penetration Tester