CVE-2026-115361 in OpenBao
Summary
by MITRE • 10/23/2026
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
OpenBao versions prior to 2.6.3 are affected by a critical Access Control List bypass vulnerability rooted in how the system processes explicit deny rules against forbidden identity metadata templates when evaluated alongside wildcard grants. This flaw allows attackers whose identity metadata contains specific patterns, such as wildcards or path segments, to circumvent security restrictions that should logically prevent access. The core technical issue lies in the evaluation logic of the ACL engine, where explicit deny directives intended to block access based on forbidden identity attributes are silently ignored if they conflict with broader wildcard permissions granted elsewhere in the policy configuration. This creates a scenario where the presence of a wildcard grant effectively nullifies specific denial rules that rely on metadata matching, leading to an unintended elevation of privileges for identities possessing those particular metadata characteristics.
The operational impact of this vulnerability is significant as it undermines the principle of least privilege within OpenBao environments. Attackers who can control or influence their identity metadata may exploit this logic flaw to access secrets, keys, or configuration data that were explicitly intended to be restricted. Because the deny rule is silently dropped rather than causing an error or rejection, the breach occurs without immediate alerting based on standard permission denials. This silent failure makes detection more difficult for security operations teams relying on audit logs of denied requests, as the system will instead log successful access attempts that violate policy intent. The vulnerability specifically targets scenarios where complex policies combine wildcard grants with fine-grained deny rules based on identity metadata templates, a common pattern in enterprise secret management setups to balance flexibility and security.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control, as the system fails to enforce intended restrictions due to flawed logic in permission evaluation. It also relates to CWE-732 Incorrect Permission Assignment for Critical Resource because the access control mechanism incorrectly assigns permissions based on incomplete rule prioritization. In terms of adversary behavior, this vulnerability facilitates lateral movement and privilege escalation within a vaulted infrastructure, mapping closely to ATT&CK techniques involving unauthorized access via misconfigured permissions or exploitation of trust relationships between identity providers and secret stores. The ability to bypass explicit denies using metadata patterns represents a sophisticated attack vector that requires careful policy auditing rather than simple brute-force attempts.
Mitigation strategies must prioritize immediate upgrading to OpenBao version 2.6.3 or later, where the ACL evaluation logic has been corrected to ensure that explicit deny rules based on forbidden identity metadata are properly enforced regardless of wildcard grants. In environments where an upgrade is not immediately feasible, administrators should review and simplify their policy configurations by removing broad wildcard grants in favor of more specific path-based permissions wherever possible. Additionally, implementing strict validation on the inputs allowed in identity metadata can reduce the attack surface for this bypass technique. Security teams should also enhance monitoring to detect unusual access patterns that might indicate exploitation of this logic flaw, particularly focusing on successful accesses to resources previously protected by deny rules tied to identity attributes. Regular audits of ACL policies are essential to ensure that complex interactions between wildcard grants and explicit denials do not reintroduce similar vulnerabilities in future configurations.