Impact In OpenBao, the "sys/storage/raft/snapshot" and "sys/storage/raft/snapshot-force" endpoint is a highly privileged endpoint to replace the current storage state, including the plugin catalog. The latter API allows replacement of storage state to a state unrelated to the current storage, without knowledge of the current seal mechanism. OpenBao allows modification of the plugin catalog via API endpoint which is then stored within encrypted storage and thus are writable by the Snapshot APIs. When OpenBao is subsequently unsealed, plugins could be loaded and executed without conforming to the "plugin_directory" set in the server's configuration, allowing an attacker with write access to this endpoint to achieve remote code execution of arbitrary binaries on the underlying system. Operators not running the Raft storage backend are not affected. This vulnerability is original to HashiCorp Vault. ## Patch This vulnerability is patched in OpenBao v2.7.0 and v2.6.3.