CVE-2026-63131

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
https://github.com/openbao/openbao/pull/3389
https://github.com/openbao/openbao/pull/3474
https://github.com/openbao/openbao/releases/tag/v2.6.0
https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr

Configurations

No configuration.

History

23 Sep 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-23 19:17

Updated : 2026-09-29 19:06

NVD link : CVE-2026-63131

Mitre link : CVE-2026-63131

CVE.ORG link : CVE-2026-63131

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-63131", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63131", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-24T14:14:55.010515Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "openbao", "product": "openbao", "versions": [{"status": "affected", "version": "< 2.6.0"}]}]}], "published": "2026-09-23T19:17:34.497", "references": [{"url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203", "source": "security-advisories@github.com"}, {"url": "https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a", "source": "security-advisories@github.com"}, {"url": "https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc", "source": "security-advisories@github.com"}, {"url": "https://github.com/openbao/openbao/pull/3389", "source": "security-advisories@github.com"}, {"url": "https://github.com/openbao/openbao/pull/3474", "source": "security-advisories@github.com"}, {"url": "https://github.com/openbao/openbao/releases/tag/v2.6.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0."}], "lastModified": "2026-09-29T19:06:32.333", "sourceIdentifier": "security-advisories@github.com"}