CVE-2026-126312: OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths
OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are OpenBao versions before 2.6.5, OpenBao 2.7.x before 2.7.2, and openbao-plugins LDAP and RADIUS auth plugin versions before 0.2.0. The issue applies to the AppRole, Cert, LDAP, and RADIUS authentication methods.
What access does an attacker need?
An attacker must be authenticated and have sufficient access to request paths handled by the affected auth methods. Exploitation uses non-canonical requests for AppRole Role IDs, Cert CRLs, LDAP groups or users, or RADIUS users.
What security control can be bypassed?
ACL deny rules can be evaded when they depend on canonical path matching. The bypass is caused by implicit path canonicalization of non-canonical plugin paths.
How can I determine whether my ACLs are exposed?
Review ACL deny rules governing AppRole Role IDs, Cert CRLs, LDAP groups and users, and RADIUS users, then determine whether the affected OpenBao or plugin versions are deployed. Configurations that rely on deny rules for these paths are relevant to the bypass.