OpenBao Identity-Based Secrets Management System Vulnerability in Access Control
CVE-2026-63131

6MEDIUM

Key Information:

Vendor

Openbao

Status
Openbao
Vendor
CVE Published:
23 September 2026

What is CVE-2026-63131?

The OpenBao identity-based secrets management system contains an access control vulnerability that can lead to unauthorized LIST operations. Prior to version 2.6.0, a flaw in the evaluation of wildcard ACL paths allowed broader permissions from parent paths to potentially bypass more restrictive policies set at child paths. This means that users could inadvertently gain access to paths that should have been restricted, creating a risk of unauthorized data exposure. The issue has been rectified in version 2.6.0, enhancing the overall security posture of the software.

Affected Version(s)

openbao < 2.6.0

References

https://github.com/openbao/openbao/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openbao/openbao/pull/3389
x_refsource_MISC
https://github.com/openbao/openbao/pull/3474
x_refsource_MISC

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.