GHSA-xp3c-3jw3-4vcr: Go/github.com/openbao/openbao vulnerability
Impact
When a policy operator has written capabilities = ["deny"] on a path with a trailing wildcard but allowed a broader list operation (e.g., a deny on secrets/metadata/restricted/ but allowed list on secrets/metadata/), OpenBao would incorrectly allow the operation. This did not impact other operation types.
Patches
This has been patched in OpenBao v2.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/openbao/openbaoto a version that resolves this vulnerability.Fixed in 0.0.0-20260713133043-f58d848c139e - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Who is exposed to this authorization bypass?
Deployments are exposed when a policy denies access using capabilities = ["deny"] on a path with a trailing wildcard while separately allowing a broader list operation that covers that path. For example, a deny on secrets/metadata/restricted/* combined with list access on secrets/metadata/* can allow listing the restricted path.
What can an attacker do if the policy is affected?
The issue incorrectly permits the list operation despite the more specific trailing-wildcard deny rule. Other operation types are not impacted.
What version fixes the issue?
The issue is patched in OpenBao v2.6.0.