CVE-2026-115366

EUVD-2026-108291
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
2.6 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.11%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openbaoopenbao
2.3.0 ≤
𝑥
< 2.6.3
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/openbao/openbao/security/advisories/GHSA-cg72-x35g-xfp8
https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-missing-root-namespace-enforcement-in-plugin-catalog-apis