---
id: "CVE-2026-126309"
page: "https://infrastack.ai/live/CVE-2026-126309"
kind: "vulnerability"
aliases: ["CVE-2026-126309"]
title: "OpenBao: path traversal in Transit key import bypasses ACL name limits"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "openbao", "secrets-management", "self-hosted"]
not_affected_if: ["no-authenticated-users", "no-transit-import"]
published_at: "2026-11-13T10:17:36+00:00"
first_seen_at: "2026-11-13T10:47:15+00:00"
updated_at: "2026-11-13T10:52:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126309", "first_seen_at": "2026-11-13T10:47:15+00:00"}]
exploit_sources: []
---

# OpenBao: path traversal in Transit key import bypasses ACL name limits

Link for people: https://infrastack.ai/live/CVE-2026-126309 (this .md is for agents)

OpenBao's Transit key import accepts traversal sequences in key names, so an attacker can write key material under names their ACL policy should block. The attacker must already hold a valid token with import permission.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenBao version with `bao version`
- Look for Transit key import use via the `transit/keys/.../import` endpoint in audit logs
- Review ACL policies that use `required_parameters` on Transit paths

## Fix

- Upgrade to `2.6.5` or `2.7.2` (fixed versions per the NVD description)

## Timeline

- 2026-11-13T10:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126309

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openbao/openbao/security/advisories/GHSA-5pmx-2p74-x478
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-path-traversal-in-transit-key-import

## From the sources

OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_