cyfenced.com →

[ CVE-2026-63131 · Published 23 Sep 2026 ]

OpenBao Skips Stricter Deny Policy for LIST operations

CVSS 6.0 EPSS <1%Fix available

[ Description ]Official description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.

[ Fixes ]Fixes and patches

[ Packages ]Affected open-source packages

  • github.com/openbao/openbao goAffected < 0.0.0-20260713133043-f58d848c139e · fixed in 0.0.0-20260713133043-f58d848c139e · GHSA-xp3c-3jw3-4vcr
  • github.com/openbao/openbao goAffected >= 0.1.0, <= 1.1.5 · GHSA-xp3c-3jw3-4vcr

[ References ]References