Incorrect authorization in OpenBao - #VU152264
Published: September 25, 2026
Vulnerability identifier: #VU152264
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass ACL deny rules and access protected resources.
The vulnerability exists due to improper authorization in OpenBao ACL policy matching when using non-canonical resource names. A remote user can use case-insensitive, whitespace-trimmed, or path-simplified names to bypass explicit deny grants and access protected resources.
Exploitation requires an ACL policy that uses broad wildcard grants with specific deny grants for excluded resources.
Affected software
OpenBao
Remediation
Install security update from vendor's website.
OpenBao - addressed in versions 2.6.3, 2.7.0