Auth bypass in Openbao
CVE-2026-115361
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.
Vulnerability class: Broken Access Control
Published .
CVSS v3 metric
CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/openbao/openbao/security/advisories/GHSA-hr5j-3j78-4vh2 (vendor-advisory)
- www.vulncheck.com/advisories/openbao-before-2.6.3-acl-bypass-via-dropped-templa… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-115361?
- CVE-2026-115361 is a medium-severity vulnerability in Openbao, classified under Incorrect Authorization. CVSS score: 4.1/10. Published 2026-10-22.
- How severe is CVE-2026-115361?
- Medium severity. CVSS v3 base score is 4.1 out of 10.