CVE-2026-115366

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.0 through 2.6.2

Description An improper authorization issue exists where privileged child-namespace tokens can modify plugin registrations. This occurs because the endpoint '/v1/sys/plugins/catalog/*' is not restricted to the root namespace. An attacker can use a child namespace's sys/ mount to remove existing registrations, create invalid ones, or register installed plugins, which can lead to a denial of service.

Recommendations Update OpenBao to version 2.6.3 or later.