{"id":"CVE-2026-63131","aliases":["BIT-openbao-2026-63131","EUVD-2026-85519","GHSA-xp3c-3jw3-4vcr","GO-2026-6579"],"status":"published","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00484,"percentile":0.42003,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-09-22T20:36:56Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Go","package":"github.com/openbao/openbao","fixed_in":["0.0.0-20260713133043-f58d848c139e"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"openbao","fixed_in":["2.6.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20260713133043-f58d848c139e"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"last_affected":"1.1.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"openbao","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260713133043-f58d848c139e"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"last_affected":"1.1.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openbao/openbao","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260713133043-f58d848c139e"},{"introduced":"0.1.0"}]}]}],"products":[{"vendor":"openbao","product":"openbao"}],"references":[{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","tags":["x_refsource_CONFIRM","web","advisory"]},{"url":"https://github.com/openbao/openbao/pull/3389","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/openbao/openbao/pull/3474","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/openbao/openbao/releases/tag/v2.6.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-xp3c-3jw3-4vcr"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63131","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63131.json","tags":["advisory"]},{"url":"https://github.com/openbao/openbao","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-63131","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","status":"published","published":"2026-09-23T17:59:16.337Z","modified":"2026-09-24T14:15:04.716Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-85519","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","status":"published","published":"2026-09-23T17:59:16Z","modified":"2026-09-24T14:15:04Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:58.638653Z"}],"ghsa":[{"id":"GHSA-xp3c-3jw3-4vcr","title":"OpenBao Skips Stricter Deny Policy for LIST operations","description":"## Impact\n\nWhen a policy operator has written `capabilities = [\"deny\"]` on a path with a trailing wildcard but allowed a broader list operation (e.g., a `deny` on `secrets/metadata/restricted/*` but allowed `list` on `secrets/metadata/*`), OpenBao would incorrectly allow the operation. This did not impact other operation types.\n\n## Patches\n\nThis has been patched in OpenBao v2.6.0.","status":"published","published":"2026-09-22T20:36:56Z","modified":"2026-09-22T20:36:57Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:41:20.575159Z"}],"nvd":[{"id":"CVE-2026-63131","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","status":"published","published":"2026-09-23T19:17:34.497Z","modified":"2026-09-29T19:06:32.333Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-63131","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","status":"published","published":"2026-09-23T17:59:16.337Z","modified":"2026-10-28T02:30:54.219611736Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"GHSA-xp3c-3jw3-4vcr","title":"OpenBao Skips Stricter Deny Policy for LIST operations","description":"## Impact\n\nWhen a policy operator has written `capabilities = [\"deny\"]` on a path with a trailing wildcard but allowed a broader list operation (e.g., a `deny` on `secrets/metadata/restricted/*` but allowed `list` on `secrets/metadata/*`), OpenBao would incorrectly allow the operation. This did not impact other operation types.\n\n## Patches\n\nThis has been patched in OpenBao v2.6.0.","status":"published","published":"2026-09-22T20:36:56Z","modified":"2026-10-01T20:55:56.794040591Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"BIT-openbao-2026-63131","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","status":"published","published":"2026-10-01T09:31:09.418Z","modified":"2026-10-01T20:55:56.794040591Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"GO-2026-6579","title":"OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao","description":"OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao","status":"published","published":"2026-10-01T20:23:38Z","modified":"2026-10-01T20:55:56.794040591Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}