CVE-2026-115365

MEDIUM 6.6

OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

CVSS Score

6.6

EPSS Score

0.0%

EPSS Percentile

0th

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.

CWE	CWE-863
Vendor	openbao
Product	openbao
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for openbao openbao

Be the first to know when new medium vulnerabilities affecting openbao openbao are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

openbao / openbao

2.3.0 < 2.6.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openbao/openbao/security/advisories/GHSA-mjch-vcw3-hhmf vulncheck.com: https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-incorrect-authorization-via-policy-cache-namespace-traversal

Credits

🔍 Michael-JRead satoqz