UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126309

OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import

Severity
High 7.6
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.6.5, 2.7.2
Weakness
CWE-73
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
Attacker can
Read data · Change data · Slow it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Sources
CVE Program

Description

OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.

From the CVE Program.

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cna:openbao|openbao
  • Every version before 2.6.5
  • From 2.7.0 before 2.7.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126309