CVE-2026-126311
OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates
CVSS Score
5.8
EPSS Score
0.0%
EPSS Percentile
0th
OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users.
| CWE | CWE-155 |
| Vendor | openbao |
| Product | openbao |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for openbao openbao
Be the first to know when new medium vulnerabilities affecting openbao openbao are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
openbao / openbao
0 < 2.6.5 2.7.0 < 2.7.2
References
Credits
🔍 manus-pi cipherboy 🔍 manus-use