CVE-2026-126312

HIGH 7.1

OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.

CWE	CWE-178
Vendor	openbao
Product	openbao
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for openbao openbao

Be the first to know when new high vulnerabilities affecting openbao openbao are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

openbao / openbao

0 < 2.6.5 2.7.0 < 2.7.2

openbao / openbao

0 < 0.2.0

openbao / openbao

0 < 0.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22 vulncheck.com: https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths

Credits

🔍 gn00295120 🔍 datosh 🔍 omar152002 🔍 ria-labs-security 🔍 HAN-BAMBO cipherboy