CVE-2026-126311: OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates
OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '' to obtain SSH certificates valid for multiple hosts or users.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments using the OpenBao SSH secrets engine with identity templates that render SSH certificate principals from unvalidated external token metadata are exposed. Exploitation typically requires compromise of, or control over metadata supplied by, an identity provider.
What does an attacker need to exploit it?
The attacker needs the ability to control external token metadata used by an identity template for SSH certificate principals. They can then inject a '*' wildcard into the rendered principal, causing issued certificates to be valid for multiple hosts or users.
Are default configurations affected?
The available information identifies exposure only where the SSH secrets engine uses identity templates populated from unvalidated external token metadata. It does not state whether this is enabled or configured by default.
What versions address the issue?
The issue is addressed in OpenBao 2.6.5 and 2.7.2. Affected releases are versions before 2.6.5 and 2.7.x releases before 2.7.2.