{"schema_version":"2","view":"grouped","data":[{"id":64610,"cve_ids":["CVE-2026-63131"],"payload":{"kind":"advisory","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-63131","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63131","aliases":["CVE-2026-63131"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"< 2.6.0"}]}],"modified":"2026-09-24T14:15:04.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63131","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:14:55.010515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:15:04.716Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:59:16.337Z"}}},"related_cves":[{"value":"CVE-2026-63131","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-63131","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-63131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63131","advisory_id":"cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","event_types":["advisory"],"published_at":"2026-10-25T19:52:29.340122+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T17:59:16.337+00:00","detail_url":"/advisories/advisory%3Acc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","group":{"id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","revision":1,"primary_event_id":63919,"change":"published","superseded_by":[],"changed":{"id":63919,"cve_ids":["CVE-2026-63131"],"payload":{"kind":"advisory","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-63131","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63131","aliases":["CVE-2026-63131"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"< 2.6.0"}]}],"modified":"2026-09-24T14:15:04.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63131","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:14:55.010515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:15:04.716Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:59:16.337Z"}}},"related_cves":[{"value":"CVE-2026-63131","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-63131","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-63131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63131","advisory_id":"cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","event_types":["advisory"],"published_at":"2026-10-25T19:52:29.340122+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T17:59:16.337+00:00","detail_url":"/events/63919"},"members":[{"id":63919,"cve_ids":["CVE-2026-63131"],"payload":{"kind":"advisory","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-63131","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63131","aliases":["CVE-2026-63131"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"< 2.6.0"}]}],"modified":"2026-09-24T14:15:04.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63131","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:14:55.010515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:15:04.716Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:59:16.337Z"}}},"related_cves":[{"value":"CVE-2026-63131","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-63131","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-63131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63131","advisory_id":"cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","event_types":["advisory"],"published_at":"2026-10-25T19:52:29.340122+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T17:59:16.337+00:00","detail_url":"/events/63919"}]}}],"next_after":64610,"next_before":64610}