PT-2026-121541

CVE-2026-115361

Published

2026-10-22

Updated

2026-10-29

Description by

CVSS 3.1

4.1

Medium

MetricsAV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3

Description An ACL bypass occurs when explicit deny rules based on forbidden identity metadata templates within wildcard grants are silently dropped. This allows attackers with identity metadata containing wildcard or path segments to access paths that should be restricted within the broader wildcard-granted scope.

Recommendations Update to version 2.6.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Cipherboy

Zer0D4Y5

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization