CVE-2026-63131CWE-863broken-access-control

CVE-2026-63131

published September 23, 2026

CVSS
6.0
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.

The record
Technical detail
CVSS
6.0 · NONE
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00354 · 27.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-23T23:17Z
References (7)
https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203 · [email protected]https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a · [email protected]https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc · [email protected]https://github.com/openbao/openbao/pull/3389 · [email protected]https://github.com/openbao/openbao/pull/3474 · [email protected]https://github.com/openbao/openbao/releases/tag/v2.6.0 · [email protected]https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr · [email protected]
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 23 SEP 17:59Z
    OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)
    cvelistv5