Log in Start free

Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-71543OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

High 7.5

In plain English

A high-severity incorrect authorization in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.5High
Exploit odds (30 days)0.4%top 63.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/openbao/openbao0.0.0-20260710001938-2d4ebafec5c5GHSA-59w7-v8rr-pr4p
Gogithub.com/openbao/openbaono fix listedGHSA-59w7-v8rr-pr4p
Gogithub.com/openbao/openbao0.0.0-20260710001938-2d4ebafec5c5GO-2026-6556

Affected products (as reported)

VendorProductVersions
openbao openbao <2.6.0

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References