CVE-2026-115365: OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

Q: Who can exploit this issue?

An attacker must already hold an OpenBao token and be able to use specially crafted policy names. Exploitation has high attack complexity and requires high privileges, according to the supplied severity vector.

Q: What is the potential impact if exploitation succeeds?

The attacker can obtain capabilities from policies cached in arbitrary namespaces, potentially including the root namespace. This can allow actions across namespace boundaries and affect confidentiality, integrity, and availability.

Q: Which deployments are affected?

OpenBao versions from 2.3.0 before 2.6.3 are affected. Deployments using namespaces and ACL policy caching are relevant because the issue involves cross-namespace references to cached policies.

Q: What should be done if immediate upgrading is not possible?

The provided information does not specify a workaround. Limit access to high-privilege tokens and review tokens and policy names for crafted references that could target policies in other namespaces until an upgrade can be performed.

Published Oct 22, 2026

Updated

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.

Affected Software

1 affected component

OpenBao OpenBao>=2.3.0<2.6.3

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already hold an OpenBao token and be able to use specially crafted policy names. Exploitation has high attack complexity and requires high privileges, according to the supplied severity vector.

What is the potential impact if exploitation succeeds?

The attacker can obtain capabilities from policies cached in arbitrary namespaces, potentially including the root namespace. This can allow actions across namespace boundaries and affect confidentiality, integrity, and availability.

Which deployments are affected?

OpenBao versions from 2.3.0 before 2.6.3 are affected. Deployments using namespaces and ACL policy caching are relevant because the issue involves cross-namespace references to cached policies.

What should be done if immediate upgrading is not possible?

The provided information does not specify a workaround. Limit access to high-privilege tokens and review tokens and policy names for crafted references that could target policies in other namespaces until an upgrade can be performed.

CVE-2026-115365: OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact if exploitation succeeds?

Which deployments are affected?

What should be done if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact if exploitation succeeds?

Which deployments are affected?

What should be done if immediate upgrading is not possible?