{"id":"CVE-2026-126309","kind":"vulnerability","aliases":["CVE-2026-126309"],"related":[],"title":"OpenBao: path traversal in Transit key import bypasses ACL name limits","description":"OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.","summary":"OpenBao's Transit key import accepts traversal sequences in key names, so an attacker can write key material under names their ACL policy should block. The attacker must already hold a valid token with import permission.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","openbao","secrets-management","self-hosted"],"not_affected_if":["no-authenticated-users","no-transit-import"],"how_to_check":"- Check the OpenBao version with `bao version`\n- Look for Transit key import use via the `transit/keys/.../import` endpoint in audit logs\n- Review ACL policies that use `required_parameters` on Transit paths","fix":"- Upgrade to `2.6.5` or `2.7.2` (fixed versions per the NVD description)","status":"open","published_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","triaged_at":"2026-11-13T10:52:41+00:00","updated_at":"2026-11-13T10:52:41+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T10:52:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `2.6.5` or `2.7.2` (fixed versions per the NVD description)","reach":"network","title":"OpenBao: path traversal in Transit key import bypasses ACL name limits","impact":"high","summary":"OpenBao's Transit key import accepts traversal sequences in key names, so an attacker can write key material under names their ACL policy should block. The attacker must already hold a valid token with import permission.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openbao","self-hosted","secrets-management"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker writes key material under arbitrary Transit key names","analyst_note":"","how_to_check":"- Check the OpenBao version with `bao version`\n- Look for Transit key import use via the `transit/keys/.../import` endpoint in audit logs\n- Review ACL policies that use `required_parameters` on Transit paths","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-transit-import","no-authenticated-users"],"who_is_affected":"Teams that run OpenBao with the Transit secrets engine and grant users key import rights limited by ACL name constraints. Deployments that do not use Transit key import, or that give no authenticated users access, are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4606,"output_tokens":501,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126309':14A,17A '-2026':13A,16A '2.6.5':64C '2.7.2':66C 'accept':31B 'acl':9A,47B,85C 'allow':77C 'alreadi':54B 'arbitrari':106C 'attack':39B,52B,79C,87C 'authent':78C 'block':50B 'bypass':8A,81C 'constraint':94C 'contain':67C 'craft':96C 'cve':12A,15A 'hold':55B 'host':25B 'import':7A,30B,60B,75C,100C 'infrastructur':18B 'key':6A,29B,35B,42B,74C,103C,108C 'limit':11A,88C 'manag':22B 'materi':43B,104C 'must':53B 'name':10A,36B,45B,82C,93C,109C 'openbao':1A,19B,26B,62C 'paramet':92C 'path':2A,69C 'permiss':61B 'polici':48B,86C 'requir':91C 'restrict':83C 'secret':21B 'secrets-manag':20B 'self':24B 'self-host':23B 'sequenc':33B,98C 'token':58B 'transit':5A,28B,73C,107C 'travers':3A,32B,70C,97C 'valid':57B 'vulner':71C 'write':41B,102C","nicknames":[],"mitigations":[],"who_affected":"Teams that run OpenBao with the Transit secrets engine and grant users key import rights limited by ACL name constraints. Deployments that do not use Transit key import, or that give no authenticated users access, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","openbao","secretsmanagement","selfhosted"],"campaign_type":null,"search_a":"'-126309':14A,17A '-2026':13A,16A 'acl':9A 'bypass':8A 'cve':12A,15A 'import':7A 'key':6A 'limit':11A 'name':10A 'openbao':1A 'path':2A 'transit':5A 'travers':3A","search_b":"'accept':31B 'acl':47B 'alreadi':54B 'attack':39B,52B 'block':50B 'hold':55B 'host':25B 'import':30B,60B 'infrastructur':18B 'key':29B,35B,42B 'manag':22B 'materi':43B 'must':53B 'name':36B,45B 'openbao':19B,26B 'permiss':61B 'polici':48B 'secret':21B 'secrets-manag':20B 'self':24B 'self-host':23B 'sequenc':33B 'token':58B 'transit':28B 'travers':32B 'valid':57B 'write':41B","search_c":"'2.6.5':64C '2.7.2':66C 'acl':85C 'allow':77C 'arbitrari':106C 'attack':79C,87C 'authent':78C 'bypass':81C 'constraint':94C 'contain':67C 'craft':96C 'import':75C,100C 'key':74C,103C,108C 'limit':88C 'materi':104C 'name':82C,93C,109C 'openbao':62C 'paramet':92C 'path':69C 'polici':86C 'requir':91C 'restrict':83C 'sequenc':98C 'transit':73C,107C 'travers':70C,97C 'vulner':71C 'write':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T22:02:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126309","severity":null,"published_at":"2026-11-13T10:17:36+00:00","modified_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","fetched_at":"2026-11-13T10:47:15+00:00","note":null}],"documents":[{"id":144949,"url":"https://github.com/openbao/openbao/security/advisories/GHSA-5pmx-2p74-x478","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T22:02:05+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144950,"url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-path-traversal-in-transit-key-import","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}