CVE-2026-126311 · Package
NO FIX YET · SEE WHAT TO DO
OpenBao's SSH secrets engine builds certificate principals from external token metadata without neutralizing '*' wildcard characters. An attacker who controls that metadata, typically through a compromised identity provider, can obtain SSH certificates valid for multiple hosts or users.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running OpenBao with the SSH secrets engine whose roles render certificate principals from identity templates fed by external token metadata. Deployments that do not use the SSH secrets engine, or that do not template principals from token metadata, are less exposed. Exposure also depends on how far the upstream identity provider can be trusted.
Not affected if no-ssh-secrets-engine, static-principals, trusted-identity-provider
Who cares openbao, self-hosted, ssh, vault-compatible
bao version; versions before 2.6.5 and 2.7.x before 2.7.2 are affected.2.6.5 and later in the 2.6 line2.7.2 and later in the 2.7 lineOpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.