CVE-2026-115361: OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

Q: Who can exploit this issue?

An attacker needs an authenticated OpenBao identity with high privileges and identity metadata containing wildcard or path segments. Exploitation is limited to paths already covered by a broader wildcard grant whose intended explicit deny rule uses a forbidden identity metadata template.

Q: Are deployments affected by default?

The provided information identifies a policy-specific condition rather than a default configuration issue. Exposure depends on using wildcard grants together with explicit deny rules templated from forbidden identity metadata.

Q: What should be done if an immediate upgrade is not possible?

Review affected ACL policies for wildcard grants paired with templated deny rules based on identity metadata. Remove or redesign those policy patterns so access restrictions do not depend on deny rules that can be silently dropped.

Q: How can administrators determine whether they are affected?

Inspect ACL policies for explicit deny rules using forbidden identity metadata templates within a broader wildcard-granted scope. Also identify identities whose metadata includes wildcard or path segments, as those identities may access paths intended to be denied.

Published Oct 22, 2026

Updated

OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.

Affected Software

1 affected component

OpenBao OpenBao<2.6.3

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated OpenBao identity with high privileges and identity metadata containing wildcard or path segments. Exploitation is limited to paths already covered by a broader wildcard grant whose intended explicit deny rule uses a forbidden identity metadata template.

Are deployments affected by default?

The provided information identifies a policy-specific condition rather than a default configuration issue. Exposure depends on using wildcard grants together with explicit deny rules templated from forbidden identity metadata.

What should be done if an immediate upgrade is not possible?

Review affected ACL policies for wildcard grants paired with templated deny rules based on identity metadata. Remove or redesign those policy patterns so access restrictions do not depend on deny rules that can be silently dropped.

How can administrators determine whether they are affected?

Inspect ACL policies for explicit deny rules using forbidden identity metadata templates within a broader wildcard-granted scope. Also identify identities whose metadata includes wildcard or path segments, as those identities may access paths intended to be denied.

CVE-2026-115361: OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected by default?

What should be done if an immediate upgrade is not possible?

How can administrators determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected by default?

What should be done if an immediate upgrade is not possible?

How can administrators determine whether they are affected?