Advisoriesby IbisOpenBaoGHSA-xp3c-3jw3-4vcr
OpenBao Skips Stricter Deny Policy for LIST operations
Fix: upgrade to 0.0.0-20260713133043-f58d848c139e or later
Impact
When a policy operator has written capabilities = ["deny"] on a path with a trailing wildcard but allowed a broader list operation (e.g., a deny on secrets/metadata/restricted/* but allowed list on secrets/metadata/*), OpenBao would incorrectly allow the operation. This did not impact other operation types.
Patches
This has been patched in OpenBao v2.6.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | < 0.0.0-20260713133043-f58d848c139e | 0.0.0-20260713133043-f58d848c139e |
| >= 0.1.0, <= 1.1.5 | No fix yet |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- BIT-openbao-2026-63131, CVE-2026-63131, GO-2026-6579
- github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
- github.com/openbao/openbao/pull/3389
- github.com/openbao/openbao/pull/3474
- github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
- github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
- github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
- github.com/openbao/openbao
- github.com/openbao/openbao/releases/tag/v2.6.0
More OpenBao advisories
All OpenBao
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackCVE-2026-63132fixed in 0.0.0-20260713141742-763625a20721OpenBao's Templated Policies Allow Privilege Escalation via Wildcard CharactersCVE-2026-71543fixed in 0.0.0-20260710001938-2d4ebafec5c5OpenBao Agent Writes Secrets to StdoutCVE-2026-77285fixed in 0.0.0-20260714163218-90272575e5f5OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesCVE-2026-55776fixed in 0.0.0-20260617104123-db57c62602b2OpenBao's System Backend allows Unauthorized Management of the containing NamespaceCVE-2026-55775fixed in 0.0.0-20260617103935-d3c1cc64b1aeOpenBao: improper authorizationCVE-2026-55774fixed in 0.0.0-20260617103932-b20b999dd404