CVE-2026-63131: Openbao

Medium severity, CVSS 6.0. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.

Affected products

• Openbao Openbao: before 2.6.0 (fixed in 2.6.0)

Published 2026-09-23. Last modified 2026-09-29.