CVE-2026-126309: OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import
OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a requiredparameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.5 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.7.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have permission to use the Transit key import functionality. The issue is relevant where ACL policies restrict imports using a required_parameters name constraint.
What capability does successful exploitation provide?
An attacker can use traversal sequences in an import request to bypass the ACL name restriction and write key material under arbitrary Transit key names.
Which versions require remediation?
OpenBao versions before 2.6.5 and before 2.7.2 are affected. Upgrade to the applicable fixed release line.