{"id":"CVE-2026-126312","kind":"vulnerability","aliases":["CVE-2026-126312"],"related":[],"title":"OpenBao: non-canonical paths let authenticated users evade ACL deny rules","description":"OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.","summary":"OpenBao's AppRole, Cert, LDAP and RADIUS auth methods canonicalize request paths implicitly, so a request with a non-canonical path can slip past ACL deny rules. An authenticated attacker can reach AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users that policy was meant to block.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["approle","ldap","openbao","package","radius","self-hosted"],"not_affected_if":["no-cert-ldap-radius-approle-auth","no-deny-acl-rules","unauthenticated-only"],"how_to_check":"- Check the OpenBao server version with `bao version`; affected builds are before `2.6.5` and `2.7.x` before `2.7.2`.\n- Check whether the LDAP or RADIUS auth plugins are installed and older than `0.2.0`.\n- Review ACL policies that deny access to AppRole, Cert, LDAP or RADIUS paths, since those are the rules that can be evaded.","fix":"- OpenBao: move to `2.6.5` or later on the 2.6 line, or `2.7.2` or later on the 2.7 line.\n- openbao-plugins LDAP and RADIUS auth plugins: move to `0.2.0` or later.","status":"open","published_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","triaged_at":"2026-11-13T10:52:42+00:00","updated_at":"2026-11-13T10:52:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:52:42Z","model":"claude-haiku-5-5","output":{"fix":"- OpenBao: move to `2.6.5` or later on the 2.6 line, or `2.7.2` or later on the 2.7 line.\n- openbao-plugins LDAP and RADIUS auth plugins: move to `0.2.0` or later.","reach":"network","title":"OpenBao: non-canonical paths let authenticated users evade ACL deny rules","impact":"medium","summary":"OpenBao's AppRole, Cert, LDAP and RADIUS auth methods canonicalize request paths implicitly, so a request with a non-canonical path can slip past ACL deny rules. An authenticated attacker can reach AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users that policy was meant to block.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openbao","self-hosted","approle","ldap","radius"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or changes restricted auth configuration","analyst_note":"","how_to_check":"- Check the OpenBao server version with `bao version`; affected builds are before `2.6.5` and `2.7.x` before `2.7.2`.\n- Check whether the LDAP or RADIUS auth plugins are installed and older than `0.2.0`.\n- Review ACL policies that deny access to AppRole, Cert, LDAP or RADIUS paths, since those are the rules that can be evaded.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-cert-ldap-radius-approle-auth","no-deny-acl-rules","unauthenticated-only"],"who_is_affected":"Teams running OpenBao as a secrets server with authentication enabled for AppRole, Cert, LDAP or RADIUS, and using ACL deny rules on those paths. The attacker needs valid credentials for some authenticated role. Deployments that do not use these auth methods or do not rely on deny rules are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00084,"input_tokens":4686,"output_tokens":742,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126312':15A,18A '-2026':14A,17A '0.2.0':97C '2.6.5':80C '2.7':82C '2.7.2':85C 'acl':10A,52B,100C,139C 'approl':19B,29B,60B,104C,125C 'attack':57B,117C 'auth':34B,94C,109C 'authent':7A,56B,116C 'block':77B 'bypass':101C 'canon':4A,47B,122C 'canonic':36B,115C 'caus':111C 'cert':30B,63B,105C,128C 'contain':98C 'crls':64B,129C 'cve':13A,16A 'deni':11A,53B,140C 'evad':9A,138C 'group':66B,131C 'host':26B 'id':62B,127C 'implicit':39B,113C 'ldap':20B,31B,65B,91C,106C,130C 'let':6A 'meant':75B 'method':35B,110C 'non':3A,46B,121C 'non-canon':2A,45B,120C 'openbao':1A,21B,27B,78C,89C 'openbao-plugin':88C 'packag':22B 'past':51B 'path':5A,38B,48B,114C,123C 'plugin':90C,95C 'polici':73B 'radius':23B,33B,70B,93C,108C,135C 'reach':59B 'request':37B,42B,119C 'role':61B,126C 'rule':12A,54B,141C 'self':25B 'self-host':24B 'slip':50B 'user':8A,68B,71B,133C,136C 'x':83C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenBao as a secrets server with authentication enabled for AppRole, Cert, LDAP or RADIUS, and using ACL deny rules on those paths. The attacker needs valid credentials for some authenticated role. Deployments that do not use these auth methods or do not rely on deny rules are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["approle","high","ldap","openbao","package","radius","selfhosted"],"campaign_type":null,"search_a":"'-126312':15A,18A '-2026':14A,17A 'acl':10A 'authent':7A 'canon':4A 'cve':13A,16A 'deni':11A 'evad':9A 'let':6A 'non':3A 'non-canon':2A 'openbao':1A 'path':5A 'rule':12A 'user':8A","search_b":"'acl':52B 'approl':19B,29B,60B 'attack':57B 'auth':34B 'authent':56B 'block':77B 'canon':47B 'canonic':36B 'cert':30B,63B 'crls':64B 'deni':53B 'group':66B 'host':26B 'id':62B 'implicit':39B 'ldap':20B,31B,65B 'meant':75B 'method':35B 'non':46B 'non-canon':45B 'openbao':21B,27B 'packag':22B 'past':51B 'path':38B,48B 'polici':73B 'radius':23B,33B,70B 'reach':59B 'request':37B,42B 'role':61B 'rule':54B 'self':25B 'self-host':24B 'slip':50B 'user':68B,71B","search_c":"'0.2.0':97C '2.6.5':80C '2.7':82C '2.7.2':85C 'acl':100C,139C 'approl':104C,125C 'attack':117C 'auth':94C,109C 'authent':116C 'bypass':101C 'canon':122C 'canonic':115C 'caus':111C 'cert':105C,128C 'contain':98C 'crls':129C 'deni':140C 'evad':138C 'group':131C 'id':127C 'implicit':113C 'ldap':91C,106C,130C 'method':110C 'non':121C 'non-canon':120C 'openbao':78C,89C 'openbao-plugin':88C 'path':114C,123C 'plugin':90C,95C 'radius':93C,108C,135C 'request':119C 'role':126C 'rule':141C 'user':133C,136C 'x':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T22:20:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126312","severity":null,"published_at":"2026-11-13T10:17:36+00:00","modified_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","fetched_at":"2026-11-13T10:47:15+00:00","note":null}],"documents":[{"id":144955,"url":"https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T22:20:29+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144956,"url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}