---
id: "CVE-2026-126312"
page: "https://infrastack.ai/live/CVE-2026-126312"
kind: "vulnerability"
aliases: ["CVE-2026-126312"]
title: "OpenBao: non-canonical paths let authenticated users evade ACL deny rules"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["approle", "ldap", "openbao", "package", "radius", "self-hosted"]
not_affected_if: ["no-cert-ldap-radius-approle-auth", "no-deny-acl-rules", "unauthenticated-only"]
published_at: "2026-11-13T10:17:36+00:00"
first_seen_at: "2026-11-13T10:47:15+00:00"
updated_at: "2026-11-13T10:52:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126312", "first_seen_at": "2026-11-13T10:47:15+00:00"}]
exploit_sources: []
---

# OpenBao: non-canonical paths let authenticated users evade ACL deny rules

Link for people: https://infrastack.ai/live/CVE-2026-126312 (this .md is for agents)

OpenBao's AppRole, Cert, LDAP and RADIUS auth methods canonicalize request paths implicitly, so a request with a non-canonical path can slip past ACL deny rules. An authenticated attacker can reach AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users that policy was meant to block.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenBao server version with `bao version`; affected builds are before `2.6.5` and `2.7.x` before `2.7.2`.
- Check whether the LDAP or RADIUS auth plugins are installed and older than `0.2.0`.
- Review ACL policies that deny access to AppRole, Cert, LDAP or RADIUS paths, since those are the rules that can be evaded.

## Fix

- OpenBao: move to `2.6.5` or later on the 2.6 line, or `2.7.2` or later on the 2.7 line.
- openbao-plugins LDAP and RADIUS auth plugins: move to `0.2.0` or later.

## Timeline

- 2026-11-13T10:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126312

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths

## From the sources

OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_