CVE-2026-115365
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy…
- Risk score
- 44/100
- CVSS
- 6.6 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the ro…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.6.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.6 medium
References
Original description
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.
Last activity 22 Oct 2026. Patch Forecast updates every hour.