7.5
High
CVE-2026-115365 OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
Description
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NExploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- High
- Interaction
- None
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
References
Timeline
- Published
- Last modified
Other CVEs of openbao
The 43 CVEs of openbao →
CVE-2026-115369
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a…
2.1
Low
CVE-2026-115366
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged…
2.0
Low
CVE-2026-115364
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by…
2.1
Low
CVE-2026-115363
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the…
2.1
Low