Most recent entries from all

BIT-openbao-2026-71543 — OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

Affected: Bitnami: openbao

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.

fkie_cve-2026-71543

GHSA-59w7-v8rr-pr4p — OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

Affected: Go: github.com/openbao/openbao

## Impact

### ACL Policies

OpenBao supports "templated polices": Policies with placeholders that are replaced at evaluation time.

This allows you to write a single policy which e.g. grants user "alice" access to all entries in a key value engine prefixed with `alice/` while granting "bob" access to `bob/`, "carol" access to `carol/`, etc.

If the data used in the template can be controlled by an attacker (e.g. your system allows the user to freely select their username) and "globbing" characters are considered valid ( e.g. `*` is a valid username) they will be able to escalate their privileges.

The problematic characters are `*`, `+` and `/`.

### PKI Secrets Engine `allowed_uri_sans_template` and `allowed_domains` Polices

The PKI secrets engine allows you to limit the "common names" a user can requests a TLS certificate for. Similar to the ACL polices this allows you to restrict e.g. "alice" to `alice.example.com`, "bob" to `bob.example.com`, etc. via templates.

Again, if an attacker can control this data freely, they can trick the PKI engine into using e.g. the `*.example.com` glob effectively allowing them to issue certificates for any subdomain of `example.com`

The problematic character in this case is `*`.

### SSH Secrets Engine `allowed_users` and `allowed_domains` Polices

The SSH secrets engine allows you to limit the "principal" a user can request as SSH certificate for. Similar to ACL and PKI, this allows templates.

The problematic character in this case…

WID-SEC-W-2026-2343 — OpenBao: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.