openbaoGHSA-xp3c-3jw3-4vcr
OpenBao Skips Stricter Deny Policy for LIST operations
MediumCVE-2026-63131 · Published Sep 22, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | < 0.0.0-20260713133043-f58d848c139e | 0.0.0-20260713133043-f58d848c139e |
| >= 0.1.0, <= 1.1.5 | No fix yet |
Details and references
## Impact When a policy operator has written `capabilities = ["deny"]` on a path with a trailing wildcard but allowed a broader list operation (e.g., a `deny` on `secrets/metadata/restricted/*` but allowed `list` on `secrets/metadata/*`), OpenBao would incorrectly allow the operation. This did not impact other operation types. ## Patches This has been patched in OpenBao v2.6.0.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- CVE-2026-63131
- github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
- github.com/openbao/openbao/pull/3389
- github.com/openbao/openbao/pull/3474
- github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
- github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
- github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
- github.com/openbao/openbao
- github.com/openbao/openbao/releases/tag/v2.6.0
More openbao advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 22 | OpenBao Agent Writes Secrets to Stdout CVE-2026-77285Lowfixed in 0.0.0-20260714163218-90272575e5f5 | Low | 0.0.0-20260714163218-90272575e5f5 |
| Sep 22 | OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters CVE-2026-71543Highfixed in 0.0.0-20260710001938-2d4ebafec5c5 | High | 0.0.0-20260710001938-2d4ebafec5c5 |
| Sep 22 | OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack CVE-2026-63132Criticalfixed in 0.0.0-20260713141742-763625a20721 | Critical | 0.0.0-20260713141742-763625a20721 |
| Jun 19 | OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types CVE-2026-55776Medium6.5fixed in 0.0.0-20260617104123-db57c62602b2 | Medium6.5 | 0.0.0-20260617104123-db57c62602b2 |
| Jun 19 | OpenBao's System Backend allows Unauthorized Management of the containing Namespace CVE-2026-55775Lowfixed in 0.0.0-20260617103935-d3c1cc64b1ae | Low | 0.0.0-20260617103935-d3c1cc64b1ae |
| Jun 19 | OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} , incomplete fix of CVE-2026-45808 CVE-2026-55774Lowfixed in 0.0.0-20260617103932-b20b999dd404 | Low | 0.0.0-20260617103932-b20b999dd404 |