Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck
CVE-2026-115361OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
Medium 4.1
In plain English
A medium-severity incorrect authorization in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.2%top 89.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
References
- GitHub Security Advisory (GHSA-hr5j-3j78-4vh2) vendor-advisory
- VulnCheck Advisory: OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial third-party-advisory