BIT-openbao-2026-115366: OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.3 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.3
Event History
Frequently Asked Questions
Which OpenBao versions are affected?
OpenBao versions from 2.3.0 up to, but not including, 2.6.3 are affected. Deployments running 2.6.3 or later are not identified as affected by the provided information.
What access does an attacker need to exploit this issue?
An attacker needs a privileged token for a child namespace and must be able to interact with the plugin catalog API through that namespace's sys/ mount. The issue does not describe exploitation by unauthenticated users or by tokens without the required child-namespace privileges.