CVE-2026-115361: OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

Severity: medium (CVSS 4.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-23
Weakness: CWE-863

Description

OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.

Affected products

openbao: before 2.6.3 — fixed in 2.6.3

How to fix

Upgrade to a fixed version: openbao 2.6.3. Check the vendor advisory for mitigations.

References

https://github.com/openbao/openbao/security/advisories/GHSA-hr5j-3j78-4vh2
https://www.vulncheck.com/advisories/openbao-before-2.6.3-acl-bypass-via-dropped-templated-policy-denial

Get alerted when CVE-2026-115361 or the next vulnerability affects your stack