CVE-2026-63131: Go/github.com/openbao/openbao vulnerability
Impact
When a policy operator has written capabilities = ["deny"] on a path with a trailing wildcard but allowed a broader list operation (e.g., a deny on secrets/metadata/restricted/ but allowed list on secrets/metadata/), OpenBao would incorrectly allow the operation. This did not impact other operation types.
Patches
This has been patched in OpenBao v2.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/openbao/openbaoto a version that resolves this vulnerability.Fixed in 0.0.0-20260713133043-f58d848c139e - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are exposed when a policy denies access with capabilities = ["deny"] on a path ending in a trailing wildcard, while a broader policy grants list access to an enclosing path. The example pattern is a deny on secrets/metadata/restricted/* combined with list permission on secrets/metadata/*.
What can an attacker do if the policy is affected?
A caller who would otherwise be blocked by the trailing-wildcard deny can perform the broader allowed list operation. The issue does not affect other operation types.
Are default configurations affected?
The issue requires a specific conflicting policy arrangement: a trailing-wildcard deny and a broader list grant. The provided information does not indicate that this arrangement is present by default.
What should be done if immediate patching is not possible?
Review policies for trailing-wildcard deny rules that overlap broader list permissions, and remove or narrow the broader list permission where it exposes denied paths. Upgrade to OpenBao v2.6.0 when possible.
How can I determine whether my deployment is affected?
Inspect policies for a deny rule such as secrets/metadata/restricted/* and a broader list grant such as secrets/metadata/*. If both apply to the same caller or token, list access may bypass the intended deny.