CVE-2026-63131
Severity not reportedOpenBao is an open source identity-based secrets management system.
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203 security-advisories@github.com
- https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a security-advisories@github.com
- https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc security-advisories@github.com
- https://github.com/openbao/openbao/pull/3389 security-advisories@github.com
- https://github.com/openbao/openbao/pull/3474 security-advisories@github.com
- https://github.com/openbao/openbao/releases/tag/v2.6.0 security-advisories@github.com
- https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr security-advisories@github.com