GitHub Advisoryadvisory · Go

GHSA-xp3c-3jw3-4vcr OpenBao Skips Stricter Deny Policy for LIST operations

MEDIUM Published 2026-09-22 Modified 2026-09-22 Official page ↗
Aliases
CVE-2026-63131
Ecosystem
Go
Packages
github.com/openbao/openbao
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-863
Reviewed
2026-09-22

Affected packages

• Go github.com/openbao/openbao: < 0.0.0-20260713133043-f58d848c139e → fixed in 0.0.0-20260713133043-f58d848c139e • Go github.com/openbao/openbao: >= 0.1.0, <= 1.1.5 (no fix yet)

Description

Impact When a policy operator has written `capabilities = ["deny"]` on a path with a trailing wildcard but allowed a broader list operation (e.g., a `deny` on `secrets/metadata/restricted/*` but allowed `list` on `secrets/metadata/*`), OpenBao would incorrectly allow the operation. This did not impact other operation types. Patches This has been patched in OpenBao v2.6.0.

Related

Alias · CVE (1)

  • CVE-2026-63131 OpenBao is an open source identity-based secrets management system. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References