ACL Bypass in OpenBao Affected by Wildcard Grant Misconfiguration
CVE-2026-115361

2.1LOW

Key Information:

Vendor

Openbao

Status
Openbao
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115361?

OpenBao versions prior to 2.6.3 have an ACL bypass vulnerability that allows attackers to overcome explicit deny rules. This issue arises when forbidden identity metadata templates are dropped within wildcard grants, enabling unauthorized access to paths that should remain restricted. Attackers leveraging identity metadata with wildcard or path segments can exploit this flaw to gain access where permissions should have otherwise barred them.

Affected Version(s)

openbao 0 < 2.6.3

openbao 2.6.3

References

https://github.com/openbao/openbao/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openbao-before-2.6.3...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zer0d4y5
cipherboy
.