Improper Authorization Vulnerability in OpenBao Plugin Management

CVE-2026-115366

What is CVE-2026-115366?

OpenBao versions prior to 2.6.3 contain an improper authorization flaw that exposes the plugin registration process in child namespaces. This loophole allows attackers to manipulate plugin registrations without proper restrictions due to the endpoint /v1/sys/plugins/catalog/* not being confined to the root namespace. Malicious actors can exploit this vulnerability to delete existing plugin registrations, create unauthorized entries, or register installed plugins, potentially leading to denial of service and disruption of functionalities.

References