CVE-2026-126309 · Infrastructure
NO FIX YET · SEE WHAT TO DO
OpenBao's Transit key import accepts traversal sequences in key names, so an attacker can write key material under names their ACL policy should block. The attacker must already hold a valid token with import permission.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run OpenBao with the Transit secrets engine and grant users key import rights limited by ACL name constraints. Deployments that do not use Transit key import, or that give no authenticated users access, are not exposed.
Not affected if no-authenticated-users, no-transit-import
Who cares openbao, secrets-management, self-hosted
bao versiontransit/keys/.../import endpoint in audit logsrequired_parameters on Transit paths2.6.5 or 2.7.2 (fixed versions per the NVD description)OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.