Skip to content
Heist/ feed
Back to feed
Low

OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

Type: advisorySources: OSV

OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-115361
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 10:38 UTC · Revision 1

Source evidence

OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

core-osv · Original source

Published 22 Oct 2026, 19:13 UTC

OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.

osv:CVE-2026-115361
Complete source record
{
  "id": "3b6404e68755ecd779d1fe19df684d6fba6e4744927046ba681bdb0e925bb9be",
  "url": "https://osv.dev/vulnerability/CVE-2026-115361",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial",
    "summary": "OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.",
    "evidence": "osv:CVE-2026-115361",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2026-115361",
      "aliases": [
        "CVE-2026-115361",
        "GHSA-hr5j-3j78-4vh2"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/openbao/openbao",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "63a65e6b907589dbb952c371a70260a065bf8bd7"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.6.3"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.6.3"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "sdk/v2.6.3",
            "v2.6.2",
            "v2.6.1",
            "sdk/v2.6.2",
            "v2.6.0",
            "sdk/v2.6.1",
            "v2.6.0-beta20260622",
            "sdk/v2.6.0",
            "api/v2.6.0",
            "api/auth/userpass/v2.6.0",
            "api/auth/ldap/v2.6.0",
            "api/auth/kubernetes/v2.6.0",
            "api/auth/jwt/v2.6.0",
            "api/auth/approle/v2.6.0",
            "v2.5.0-beta20251125",
            "sdk/v2.5.0",
            "api/v2.5.0",
            "api/auth/userpass/v2.5.0",
            "api/auth/ldap/v2.5.0",
            "api/auth/kubernetes/v2.5.0",
            "api/auth/jwt/v2.5.0",
            "api/auth/approle/v2.5.0",
            "v2.4.0",
            "sdk/v2.4.0",
            "api/v2.4.0",
            "api/auth/userpass/v2.4.0",
            "api/auth/ldap/v2.4.0",
            "api/auth/kubernetes/v2.4.0",
            "api/auth/jwt/v2.4.0",
            "api/auth/approle/v2.4.0",
            "v2.3.0-beta20250528",
            "sdk/v2.3.0",
            "api/v2.3.0",
            "api/auth/userpass/v2.3.0",
            "api/auth/ldap/v2.3.0",
            "api/auth/kubernetes/v2.3.0",
            "api/auth/approle/v2.3.0",
            "dev-namespaces-base-20250424",
            "dev-namespaces-base-20250311",
            "v2.2.0-beta20250213",
            "dev-namespaces-base-20250215",
            "sdk/v2.2.0",
            "api/v2.2.0",
            "api/auth/userpass/v2.2.0",
            "api/auth/ldap/v2.2.0",
            "api/auth/kubernetes/v2.2.0",
            "api/auth/approle/v2.2.0",
            "v2.1.0-beta20241114.3",
            "v2.1.0-beta20241114.2",
            "v2.1.0-beta20241114.1",
            "v2.1.0-beta20241114",
            "sdk/v2.1.0",
            "api/v2.1.0",
            "v2.0.0",
            "sdk/v2.0.1",
            "api/v2.0.1",
            "api/auth/userpass/v2.0.1",
            "api/auth/ldap/v2.0.1",
            "api/auth/kubernetes/v2.0.1",
            "api/auth/approle/v2.0.1",
            "v2.0.0-beta20240618",
            "sdk/v1.100.0-development20240408",
            "api/v1.100.0-development20240408",
            "api/auth/userpass/v1.1.0-development20240408",
            "api/auth/ldap/v1.1.0-development20240408",
            "api/auth/kubernetes/v1.1.0-development20240408",
            "api/auth/gcp/v1.1.0-development20240408",
            "api/auth/azure/v1.1.0-development20240408",
            "api/auth/aws/v1.1.0-development20240408",
            "api/auth/approle/v1.1.0-development20240408",
            "v2.0.0-alpha20240329",
            "before-plugin-removal",
            "api/auth/userpass/v0.4.1",
            "api/auth/gcp/v0.4.1",
            "api/auth/azure/v0.4.1",
            "api/auth/aws/v0.4.1",
            "api/auth/approle/v0.4.1",
            "sdk/v0.9.1",
            "api/v1.9.2",
            "api/v1.9.1",
            "sdk/v0.9.0",
            "api/auth/userpass/v0.4.0",
            "api/auth/gcp/v0.4.0",
            "api/auth/azure/v0.4.0",
            "api/auth/aws/v0.4.0",
            "api/auth/approle/v0.4.0",
            "sdk/v0.8.0",
            "api/v1.9.0",
            "api/v1.8.3",
            "sdk/v0.7.0",
            "sdk/v0.6.2",
            "sdk/v0.6.1",
            "api/v1.8.2",
            "api/v1.8.1",
            "api/auth/userpass/v0.3.0",
            "api/auth/gcp/v0.3.0",
            "api/auth/azure/v0.3.0",
            "api/auth/aws/v0.3.0",
            "api/auth/approle/v0.3.0",
            "api/v1.8.0",
            "sdk/v0.6.0",
            "api/auth/userpass/v0.2.0",
            "api/auth/gcp/v0.2.0",
            "api/auth/azure/v0.2.0",
            "api/auth/aws/v0.2.0",
            "api/auth/approle/v0.2.0",
            "sdk/v0.5.3",
            "api/v1.7.2",
            "sdk/v0.5.1",
            "api/v1.7.1",
            "api/v1.7.0",
            "api/v1.6.0",
            "sdk/v0.5.0",
            "api/v1.5.0",
            "sdk/v0.4.1",
            "api/v1.3.1",
            "api/auth/approle/v0.1.1",
            "api/auth/gcp/v0.1.0",
            "api/auth/azure/v0.1.0",
            "api/auth/userpass/v0.1.0",
            "api/auth/aws/v0.1.0",
            "api/auth/approle/v0.1.0",
            "sdk/v0.3.0",
            "api/v1.2.0",
            "api/v1.1.1",
            "sdk/v0.2.1",
            "api/v1.0.4",
            "sdk/v0.1.13",
            "api/v1.0.3",
            "sdk/v0.1.12",
            "sdk/v0.1.11",
            "sdk/v0.1.10",
            "api/v1.0.2",
            "sdk/v0.1.9",
            "api/v1.0.1",
            "sdk/v0.1.8"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115361.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.428404791Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115361.json",
        "https://github.com/openbao/openbao/security/advisories/GHSA-hr5j-3j78-4vh2",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-115361",
        "https://www.vulncheck.com/advisories/openbao-before-2.6.3-acl-bypass-via-dropped-templated-policy-denial"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-863"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115361.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-115361",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 519028,
  "published_at": "2026-10-22T19:13:36.151+00:00"
}