Live › vulnerability › CVE-2026-115361
Go to dashboardOpenBao before 2.6.3 silently drops explicit deny rules when they are based on forbidden identity metadata templates inside wildcard grants. An attacker whose identity metadata contains wildcard or path segments can reach paths that should have been denied.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OpenBao before 2.6.3 whose ACL policies combine wildcard path grants with identity metadata templates. Deployments that use only static, non-templated policies are less exposed; the sources do not say more.
No product ranges from the sources yet.
bao version and compare it to 2.6.3.{{identity.entity.metadata.*}}) together with wildcard path grants.2.6.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.
This page as .md · .json · in your agent: get_signal("CVE-2026-115361")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.