CVE-2026-115365

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.0 through 2.6.2

Description An incorrect authorization issue exists in the ACL policy cache. This allows tokens to reference policies from arbitrary namespaces through the use of specially crafted policy names. Consequently, attackers possessing these tokens can acquire the capabilities of cached policies in other namespaces, including the root namespace, enabling them to operate across namespace boundaries.

Recommendations Update OpenBao to version 2.6.3 or later.