Live › vulnerability › CVE-2026-115366
Go to dashboardOpenBao from 2.3.0 before 2.6.3 lets a privileged token in a child namespace change plugin catalog registrations, because the /v1/sys/plugins/catalog/ endpoints are not limited to the root namespace. An attacker can delete registrations, create invalid ones, or register installed plugins, which can cause denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments running OpenBao 2.3.0 through 2.6.2 that use namespaces and hand out privileged tokens inside child namespaces. Single-namespace deployments and installations that do not give child-namespace tokens privileged access are less exposed.
No product ranges from the sources yet.
bao version; versions from 2.3.0 up to but not including 2.6.3 are affected.bao namespace list; the issue needs a child namespace with a privileged token.2.6.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-115366")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.