{"id":"CVE-2026-115365","kind":"vulnerability","aliases":["CVE-2026-115365"],"related":[],"title":"OpenBao: ACL policy cache lets tokens borrow policies from other namespaces","description":"OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.","summary":"OpenBao versions from 2.3.0 before 2.6.3 cache ACL policies without checking namespace, so a crafted policy name lets a token reference policies from other namespaces. An attacker holding such a token can gain the capabilities of those policies, including root namespace policies, and act across namespace boundaries.","severity":"high","cvss":7.5,"epss":0.00304,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-tenant","openbao","package","secrets-management","self-hosted"],"not_affected_if":["not-on-affected-versions","single-namespace"],"how_to_check":"- Run `bao version` and confirm whether the installed version is below `2.6.3`\n- Review whether multiple namespaces are in use and which tokens hold policies in them","fix":"- Upgrade OpenBao to `2.6.3` or later\n- Rotate tokens that may have been issued to untrusted parties in multi-namespace deployments","status":"open","published_at":"2026-10-22T19:17:42+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:15:07+00:00","updated_at":"2026-10-25T03:15:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:15:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenBao to `2.6.3` or later\n- Rotate tokens that may have been issued to untrusted parties in multi-namespace deployments","reach":"network","title":"OpenBao: ACL policy cache lets tokens borrow policies from other namespaces","impact":"high","summary":"OpenBao versions from 2.3.0 before 2.6.3 cache ACL policies without checking namespace, so a crafted policy name lets a token reference policies from other namespaces. An attacker holding such a token can gain the capabilities of those policies, including root namespace policies, and act across namespace boundaries.","category":"package","nicknames":[],"who_cares":["openbao","self-hosted","secrets-management","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker gains root namespace policy capabilities across tenant boundaries","analyst_note":"","how_to_check":"- Run `bao version` and confirm whether the installed version is below `2.6.3`\n- Review whether multiple namespaces are in use and which tokens hold policies in them","needs_analyst":false,"not_affected_if":["single-namespace","not-on-affected-versions"],"who_is_affected":"Teams running OpenBao 2.3.0 up to but not including 2.6.3, especially deployments that use namespaces to separate tenants or teams. Single-namespace deployments with no untrusted token holders are less exposed. unknown whether default configurations are affected beyond this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000612,"input_tokens":3389,"output_tokens":547,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115365':14A,17A '-2026':13A,16A '2.3.0':32B,78C '2.6.3':34B,80C 'acl':2A,36B,88C 'across':73B,124C 'act':72B,123C 'allow':92C 'arbitrari':98C 'attack':55B,105C 'author':84C 'borrow':7A 'boundari':75B,126C 'cach':4A,35B,90C,113C 'capabl':63B,111C 'check':39B 'contain':81C 'craft':43B,102C 'cve':12A,15A 'gain':61B,110C 'hold':56B,106C 'host':28B 'includ':67B,118C 'incorrect':83C 'let':5A,46B 'manag':25B 'multi':19B 'multi-ten':18B 'name':45B,104C 'namespac':11A,40B,53B,69B,74B,99C,117C,121C,125C 'openbao':1A,21B,29B,76C 'packag':22B 'polici':3A,8A,37B,44B,50B,66B,70B,89C,96C,103C,114C 'refer':49B,95C 'root':68B,120C 'secret':24B 'secrets-manag':23B 'self':27B 'self-host':26B 'special':101C 'tenant':20B 'token':6A,48B,59B,93C,108C 'use':100C 'version':30B 'vulner':85C 'without':38B","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenBao 2.3.0 up to but not including 2.6.3, especially deployments that use namespaces to separate tenants or teams. Single-namespace deployments with no untrusted token holders are less exposed. unknown whether default configurations are affected beyond this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115365","severity":null,"published_at":"2026-10-22T19:17:42+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115365","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115365","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}