CVE-2026-115361
OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
CVSS Score
4.1
EPSS Score
0.0%
EPSS Percentile
0th
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.
| CWE | CWE-863 |
| Vendor | openbao |
| Product | openbao |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for openbao openbao
Be the first to know when new medium vulnerabilities affecting openbao openbao are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
openbao / openbao
0 < 2.6.3
References
Credits
🔍 zer0d4y5 cipherboy