Most recent entries from all

fkie_cve-2026-63131

2026-09-29T11:18:14.353874+00:00

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.

GHSA-xp3c-3jw3-4vcr — OpenBao Skips Stricter Deny Policy for LIST operations

2026-09-29T11:18:14.354015+00:00

Affected: Go: github.com/openbao/openbao

## Impact

When a policy operator has written `capabilities = ["deny"]` on a path with a trailing wildcard but allowed a broader list operation (e.g., a `deny` on `secrets/metadata/restricted/*` but allowed `list` on `secrets/metadata/*`), OpenBao would incorrectly allow the operation. This did not impact other operation types.

## Patches

This has been patched in OpenBao v2.6.0.