---
id: "CVE-2026-115365"
kind: "vulnerability"
aliases: ["CVE-2026-115365"]
title: "OpenBao: ACL policy cache lets tokens borrow policies from other namespaces"
severity: "high"
cvss: 7.5
epss: 0.00304
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multi-tenant", "openbao", "package", "secrets-management", "self-hosted"]
not_affected_if: ["not-on-affected-versions", "single-namespace"]
published_at: "2026-10-22T19:17:42+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:15:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115365", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115365", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# OpenBao: ACL policy cache lets tokens borrow policies from other namespaces

OpenBao versions from 2.3.0 before 2.6.3 cache ACL policies without checking namespace, so a crafted policy name lets a token reference policies from other namespaces. An attacker holding such a token can gain the capabilities of those policies, including root namespace policies, and act across namespace boundaries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `bao version` and confirm whether the installed version is below `2.6.3`
- Review whether multiple namespaces are in use and which tokens hold policies in them

## Fix

- Upgrade OpenBao to `2.6.3` or later
- Rotate tokens that may have been issued to untrusted parties in multi-namespace deployments

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115365
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115365

## From the sources

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_