CVE-2026-71543

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.0

Description Templated ACL, PKI, and SSH policies fail to reject syntax-significant characters when substituting attacker-controlled identity data. In ACL templated policies, characters such as asterisks, plus signs, and slashes can alter path matching. In PKI allowed uri sans template and allowed domains policies, an asterisk can expand certificate issuance to unauthorized domains. In SSH allowed users and allowed domains policies, a comma can be used to add unauthorized principals. This issue can lead to privilege escalation, unauthorized access, and unauthorized certificate issuance. Exploitation is possible when deployments use templated policy data that users can freely modify, though templates based on the randomly generated identity.entity.id value are not affected.

Recommendations Update to version 2.6.0.