BIT-openbao-2026-115365: OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.3
Event History
Frequently Asked Questions
Which deployments are affected?
OpenBao deployments running versions from 2.3.0 up to, but not including, 2.6.3 are affected. The listed software package is bitnami/openbao.
What access does an attacker need to exploit this issue?
An attacker needs to hold an OpenBao token and use specially crafted policy names that reference policies in other namespaces. The vulnerability is network-reachable and requires high privileges, with no user interaction required.
What could an attacker do if exploitation succeeds?
The attacker can obtain capabilities associated with cached policies in arbitrary namespaces, including the root namespace. This can allow actions across namespace boundaries and affect confidentiality, integrity, and availability.
How can I remediate the issue?
Upgrade OpenBao to version 2.6.3 or later. The provided data does not identify a mitigation for deployments that cannot be upgraded immediately.