UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126311

OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates

Severity
Medium 4.6
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.6.5, 2.7.2
Weakness
CWE-155
Attack
Over the network · Only under certain conditions · Needs an administrator account · No user action needed
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
Sources
CVE Program

Description

OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users.

From the CVE Program.

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cna:openbao|openbao
  • Every version before 2.6.5
  • From 2.7.0 before 2.7.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126311