BIT-openbao-2026-115361: OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.3
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an attacker with high privileges whose identity metadata contains wildcard or path segments. The affected policy must use a wildcard grant together with an explicit deny rule based on a forbidden identity metadata template.
What policy configurations are affected?
Affected configurations include broader wildcard grants that rely on templated explicit-deny rules to exclude paths derived from identity metadata. If the metadata template is forbidden, OpenBao can silently drop the deny rule, leaving the wildcard-granted paths accessible.
How can I determine whether my deployment is affected?
Review ACL policies for explicit deny rules containing identity metadata templates, especially where those denies narrow a wildcard grant. Check whether identities that can use those policies have metadata values containing wildcard characters or path segments.
What should be done if an immediate upgrade is not possible?
Avoid relying on templated deny rules to restrict wildcard grants, and replace affected wildcard permissions with explicit allow rules for only the required paths. Restrict or sanitize identity metadata values so they cannot contain wildcard or path-segment values.