Live › vulnerability › CVE-2026-63131
Go to dashboardOpenBao's ACL evaluation can apply a broader wildcard allow before a more specific deny on a child path when a LIST request is made. An authenticated user can therefore list secret paths that policy explicitly denies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/openbao/openbao | go | >= 0.1.0, < 0.0.0-20260713133043-f58d848c139e | 0.0.0-20260713133043-f58d848c139e |
Unknown from the sources.
Upgrade github.com/openbao/openbao to 0.0.0-20260713133043-f58d848c139e or later (OpenBao 2.6.0).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-63131")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.