CVE-2026-115361

EUVD-2026-108286
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.1 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.02%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openbaoopenbao
𝑥
< 2.6.3
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/openbao/openbao/security/advisories/GHSA-hr5j-3j78-4vh2
https://www.vulncheck.com/advisories/openbao-before-2.6.3-acl-bypass-via-dropped-templated-policy-denial