Free tools Windows power users keep installed
One-click scans. No signup required.
OpenBao has a critical Raft snapshot vulnerability that can lead to code execution, but it is not a direct unauthenticated entry point: the project’s advisory says an attacker needs high privileges to write to the snapshot API. Separately, ControlPlane describes a conditional, multi-vulnerability route from network access to that required privilege. That scenario depends on a specific combination of enabled features, identities, namespace and policy settings; it does not mean every OpenBao deployment is exposed.
Two routes, with different prerequisites
The critical issue is in Raft snapshot replacement. ControlPlane’s account of an unauthenticated-to-code-execution route combines that flaw with three other vulnerabilities to construct a privilege-escalation path. Treat these as distinct: the snapshot advisory’s high-privilege requirement is not erased by the separate chain, which describes how particular deployment conditions might let an attacker reach the needed capability.
| Aspect | Direct snapshot vulnerability | ControlPlane’s chained scenario |
|---|---|---|
| Storage and configuration | Requires Raft storage; the OpenBao advisory says deployments not using Raft are not affected by this flaw. | Requires a combination of configured ACME issuance, certificate authentication, namespace and policy conditions, and a root-namespace snapshot-restore service role. |
| Starting privilege | High privileges are required to write to the vulnerable snapshot API, according to the advisory’s CVSS v4 metrics. | Begins with network access and constructs a path to greater privileges under the assumptions in ControlPlane’s scenario. |
| What leads to code execution | Replacing storage state can alter the encrypted plugin catalog; after unseal, a registered plugin can run outside the configured plugin directory. | The chain uses the ACME SAN issue, ACL deny bypass and cross-namespace policy-cache issue to reach snapshot restore, then uses the snapshot flaw. |
| Remediation coverage | Disabling plugins can interrupt this execution path, but can also prevent legitimate registered plugins from working. | Individual configuration changes address only parts of the chain; upgrading to a patched version addresses the listed vulnerabilities. |
The critical Raft snapshot flaw
OpenBao advisory GHSA-j6wc-jpvg-xfxq, published September 23, 2026, identifies CVE-2026-104090 and rates it Critical with a CVSS v4 score of 9.4. It affects versions earlier than 2.6.3; the advisory lists 2.6.3 and 2.7.0 as patched. Its metrics specify a network attack vector, low attack complexity, no attack requirements, high privileges required and no user interaction.
The vulnerable sys/storage/raft/snapshot and sys/storage/raft/snapshot-force APIs can replace storage state, including the plugin catalog. The force endpoint can replace state unrelated to the current storage without knowing the current seal mechanism. Since plugin catalog data is in encrypted storage but writable through these snapshot APIs, someone with write access can arrange for arbitrary binaries to execute after OpenBao is unsealed. The advisory explicitly excludes deployments that do not use Raft storage from this specific flaw.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How the conditional unauthenticated-to-RCE chain works
In a September 28, 2026 article, ControlPlane’s Alex Scheel describes a technical scenario combining the snapshot flaw with three other issues. ControlPlane reports CVSS v4 scores of 8.2 for the ACME SAN validation bypass, 7.7 for cross-namespace policy-cache access and 7.6 for the ACL denial bypass via non-canonical URLs. These scores describe issue severity, not the likelihood that a particular OpenBao installation is exploitable.
1. Obtain a certificate with an additional identity
The ACME issue, OpenBao advisory GHSA-x8fg-h69x-p28, applies when an operator has enabled and configured OpenBao’s PKI ACME support. An attacker who can validate for an allowed domain may be able to obtain a certificate containing additional SAN types that ACME itself cannot issue, such as an email address. ControlPlane uses an unvalidated URI SAN as the identity in its scenario. The advisory rates this issue High at CVSS v4 8.2 and lists 2.6.3 and 2.7.0 as patched.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
2. Authenticate as a provisioner and bypass an explicit deny
The scenario assumes a service provisioner can update selected fields in a Certificate Auth role. It then uses the certificate identity to authenticate as that provisioner. A separate ACL issue allows non-canonical resource names—such as case-insensitive, whitespace-trimmed or path-simplified forms—to bypass an explicit deny when broader wildcard grants exist. This is not a universal ACL bypass; the relevant policy shape matters. OpenBao advisory GHSA-fg5x-7whg-6c28 identifies this issue and lists 2.6.3 and 2.7.0 as patched.
3. Cross the namespace boundary and restore a snapshot
The final privilege step relies on a policy-cache issue: specially crafted policy names can reference policies in arbitrary namespaces, including root, if the named policies are resident in OpenBao’s in-memory LRU cache both when the token is created and when it is used. ControlPlane’s scenario also assumes a sandboxed namespace, an administrator role whose token_policies can be modified by an admin, and a root-namespace snapshot-service role capable of restoring Raft. With those conditions, the chain reaches snapshot restore and can use the critical flaw to cause code execution.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
The full chain therefore depends on more than an internet-reachable OpenBao service. Operators need to assess whether the specific feature, identity, authorization and snapshot-service conditions in the scenario exist in their deployment. ControlPlane says the attack actions have recognizable audit-log signatures and may be detectable; that is the author’s assessment, not a guarantee that monitoring will catch every attempt.
What operators should do
- Upgrade first. Move affected deployments to OpenBao 2.6.3 or 2.7.0, the patched releases named by the September 23 advisories and recommended by ControlPlane. Confirm that the deployed version is actually running after the upgrade.
- Confirm the storage backend. Establish whether the deployment uses Raft. Non-Raft storage removes exposure to the specific snapshot RCE described in GHSA-j6wc-jpvg-xfxq, but does not by itself resolve the other vulnerabilities or their separate applicability conditions.
- Review the chain’s prerequisites. Check whether PKI ACME is enabled, whether certificate authentication uses SAN identities, whether provisioners can alter Certificate Auth role fields, whether wildcard grants coexist with explicit denies, and whether namespace policies or token-policy changes could expose root-level capabilities. Also review which principals can restore Raft snapshots.
- Use interim mitigations only for the issue they cover. ControlPlane says removing
plugin_directorycan block the plugin execution path, but registered legitimate plugins will also be blocked. TheBAO_DISABLE_PUBLIC_ACMEsetting can require External Account Binding (EAB) for ACME; requiring EAB may be a breaking change if clients do not already support it. Requiring EAB addresses the ACME portion, not the rest of the chain. - Weigh cache and ACL workarounds carefully. The policy-cache advisory documents
disable_cache = trueas a workaround and warns of significant performance impact. For the non-canonical URL issue, adding grants for every possible exclusion format is the stated workaround, but may be impractical. Neither is a substitute for upgrading.
Disclosure dates and what they do—and do not—show
ControlPlane’s timeline says the snapshot RCE and policy canonicalization issue were disclosed September 4, 2026; the namespace traversal report arrived September 8; the ACME issue was formally disclosed September 17; and OpenBao 2.6.3 and 2.7.0 shipped September 23. The official advisories for these issues were published September 23, followed by ControlPlane’s technical chain analysis on September 28. OpenBao’s advisory index also listed advisories published October 1, 2026; those later entries should not be assumed to be part of this four-issue chain without checking their individual relevance.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The advisories and ControlPlane analysis establish serious technical impact and identify patched versions. They do not establish how many deployments are affected, how often the vulnerabilities have been exploited, or how many victims there are. Severity scores are not prevalence estimates.
Quick Recap
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
