CVE-2026-126311

EUVD-2026-125209
OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.8 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.63%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
openbaoopenbao
𝑥
< 2.6.5
CNA
openbaoopenbao
2.7.0 ≤
𝑥
< 2.7.2
CNA
Common Weakness Enumeration
References
https://github.com/openbao/openbao/security/advisories/GHSA-h76r-48x5-36hg
https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-wildcard-principals-in-ssh-certificates-via-identity-templates