CVE-2026-126312 · Package
NO FIX YET · SEE WHAT TO DO
OpenBao's AppRole, Cert, LDAP and RADIUS auth methods canonicalize request paths implicitly, so a request with a non-canonical path can slip past ACL deny rules. An authenticated attacker can reach AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users that policy was meant to block.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running OpenBao as a secrets server with authentication enabled for AppRole, Cert, LDAP or RADIUS, and using ACL deny rules on those paths. The attacker needs valid credentials for some authenticated role. Deployments that do not use these auth methods or do not rely on deny rules are less exposed.
Not affected if no-cert-ldap-radius-approle-auth, no-deny-acl-rules, unauthenticated-only
Who cares approle, ldap, openbao, radius, self-hosted
bao version; affected builds are before 2.6.5 and 2.7.x before 2.7.2.0.2.0.2.6.5 or later on the 2.6 line, or 2.7.2 or later on the 2.7 line.OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
0.2.0 or later.