CVE-2026-115361GHSA-hr5j-3j78-4vh2
OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
openbao openbao
CVSS
2.1LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.6.3openbaoCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.
Text from CVE List
Affected versions 2
- openbaoaffected: all versions before 2.6.3CVE List
- openbaounaffected: 2.6.3CVE List