Impact OpenBao's PKI engine supports the Automatic Certificate Management Environment (ACME - RFC 8555) protocol for certificate issuance. When enabled and configured by an operator, PKI did not correctly validate the certificate's SANs against the ACME protocol's completed orders, letting an attacker who can successfully validate for any allowed domain acquire a certificate also valid for any number of non-validated SANs. These SANs must be for a type non-issuable through the ACME protocol (e.g., email addresses). This vulnerability is original to HashiCorp Vault. ## Patch This vulnerability is patched in OpenBao v2.7.0 and v2.6.3.