Live › vulnerability › CVE-2026-115365
Go to dashboardOpenBao versions from 2.3.0 before 2.6.3 cache ACL policies without checking namespace, so a crafted policy name lets a token reference policies from other namespaces. An attacker holding such a token can gain the capabilities of those policies, including root namespace policies, and act across namespace boundaries.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OpenBao 2.3.0 up to but not including 2.6.3, especially deployments that use namespaces to separate tenants or teams. Single-namespace deployments with no untrusted token holders are less exposed. unknown whether default configurations are affected beyond this.
No product ranges from the sources yet.
bao version and confirm whether the installed version is below 2.6.32.6.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.
This page as .md · .json · in your agent: get_signal("CVE-2026-115365")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.