GHSA-mjch-vcw3-hhmf: OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

Q: Which deployments are affected?

OpenBao versions from 2.3.0 up to, but not including, 2.6.3 are affected. The issue concerns ACL policy-cache handling in namespace-enabled deployments where policies may be cached across namespaces.

Q: What access does an attacker need to exploit this issue?

An attacker needs to hold a token that can reference a specially crafted policy name. Exploitation does not require user interaction, but the attacker must be able to use such a token.

Q: What could an attacker do after successful exploitation?

The attacker can obtain the capabilities of cached policies from arbitrary namespaces, potentially including the root namespace. This can allow actions across namespace boundaries with the permissions granted by the referenced cached policy.

Q: What should teams do if they cannot immediately upgrade?

The provided information does not identify a workaround. Prioritize upgrading to 2.6.3 or later and restrict access to tokens that could be used to reference crafted policy names until remediation is complete.

Published Oct 22, 2026

Updated

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.

Affected Software

1 affected componentFixes available

bitnami/openbao>=2.3.0<2.6.3

2.6.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/openbao to a version that resolves this vulnerability.
Fixed in 2.6.3

Event History

Oct 22, 2026

CVE Published

via OSV·07:13 PM

Data Sourced

via OSV·07:13 PM

DescriptionSeverityWeakness

Oct 29, 2026

Advisory Published

via OSV·08:54 AM

Data Sourced

via OSV·08:54 AM

Affected Software

Frequently Asked Questions

Which deployments are affected?

OpenBao versions from 2.3.0 up to, but not including, 2.6.3 are affected. The issue concerns ACL policy-cache handling in namespace-enabled deployments where policies may be cached across namespaces.

What access does an attacker need to exploit this issue?

An attacker needs to hold a token that can reference a specially crafted policy name. Exploitation does not require user interaction, but the attacker must be able to use such a token.

What could an attacker do after successful exploitation?

The attacker can obtain the capabilities of cached policies from arbitrary namespaces, potentially including the root namespace. This can allow actions across namespace boundaries with the permissions granted by the referenced cached policy.

What should teams do if they cannot immediately upgrade?

The provided information does not identify a workaround. Prioritize upgrading to 2.6.3 or later and restrict access to tokens that could be used to reference crafted policy names until remediation is complete.

GHSA-mjch-vcw3-hhmf: OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What could an attacker do after successful exploitation?

What should teams do if they cannot immediately upgrade?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What could an attacker do after successful exploitation?

What should teams do if they cannot immediately upgrade?