CVE-2026-126312
EUVD-2026-12520813.11.2026, 10:17
OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| openbao | openbao | 𝑥 < 2.6.5 | CNA |
| openbao | openbao | 2.7.0 ≤ 𝑥 < 2.7.2 | CNA |
| openbao | openbao | 𝑥 < 0.2.0 | CNA |
Common Weakness Enumeration