Incorrect authorization in OpenBao - #VU152260
Published: September 25, 2026
Vulnerability identifier: #VU152260
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass access control restrictions.
The vulnerability exists due to improper authorization in policy evaluation when evaluating policies containing a global explicit wildcard grant and a narrow denial based on a forbidden identity template. A remote privileged user can cause the denial to be dropped and access resources covered by the broader wildcard grant to bypass access control restrictions.
In most cases, the relevant identity metadata is set by an identity provider trusted by OpenBao.
Affected software
OpenBao
Remediation
Install security update from vendor's website.
OpenBao - addressed in versions 2.6.3, 2.7.0