CVE-2026-126312

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.5 OpenBao versions 2.7.x prior to 2.7.2 openbao-plugins LDAP and RADIUS auth plugins versions prior to 0.2.0

Description An ACL bypass exists in the AppRole, Cert, LDAP, and RADIUS authentication methods due to implicit path canonicalization. Path canonicalization is the process of converting a file path or URL into a standard, unique representation. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.

Recommendations Update OpenBao to version 2.6.5 or later. Update OpenBao versions 2.7.x to 2.7.2 or later. Update openbao-plugins LDAP and RADIUS auth plugins to version 0.2.0 or later.