UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126312

OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths

Severity
High 7.6
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
0.2.0, 2.6.5, 2.7.2
Weakness
Case-sensitivity mistakes (CWE-178)
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
Attacker can
Read data · Change data · Slow it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Sources
CVE Program

Description

OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.

From the CVE Program.

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cna:openbao|openbao
  • Every version before 0.2.0
  • From 2 before 2.6.5
  • From 2.7.0 before 2.7.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126312