{"id":"EUVD-2026-85519","enisaUuid":"c14ac227-96e4-37dd-92fc-8dfd354ad866","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao\u0027s vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities \u003d [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory\u0027s affected scope. This issue is fixed in version 2.6.0.","datePublished":"Sep 23, 2026, 5:59:16 PM","dateUpdated":"Sep 24, 2026, 2:15:04 PM","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr\nhttps://github.com/openbao/openbao/pull/3389\nhttps://github.com/openbao/openbao/pull/3474\nhttps://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a\nhttps://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc\nhttps://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203\nhttps://github.com/openbao/openbao/releases/tag/v2.6.0\n","aliases":"CVE-2026-63131\nGHSA-xp3c-3jw3-4vcr\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"521e738b-f8f3-3a41-91d1-07df70a294a0","product":{"name":"openbao","vendor":{"name":"openbao"}},"product_version":"\u003c 2.6.0"}],"enisaIdVendor":[{"id":"83c0ee7c-3389-35c2-9055-d6fbac6958ab","vendor":{"name":"openbao"}}],"enisaIdVulnerability":[{"id":"5ff163eb-8505-3c24-a6e2-334dcc8d6d6c","vulnerability":{"id":"GHSA-xp3c-3jw3-4vcr","description":"OpenBao Skips Stricter Deny Policy for LIST operations","datePublished":"Sep 22, 2026, 8:36:56 PM","dateUpdated":"Sep 22, 2026, 8:36:56 PM","baseScore":0.0,"references":"https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr\nhttps://github.com/openbao/openbao/pull/3389\nhttps://github.com/openbao/openbao/pull/3474\nhttps://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a\nhttps://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc\nhttps://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203\nhttps://github.com/openbao/openbao\nhttps://github.com/openbao/openbao/releases/tag/v2.6.0\n","enisa_id":"EUVD-2026-85519\n","aliases":"GHSA-xp3c-3jw3-4vcr\nCVE-2026-63131\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d7ce8f18-d31e-321b-bb08-fc024cc7695f","vulnerability":{"id":"CVE-2026-63131","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao\u0027s vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities \u003d [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory\u0027s affected scope. This issue is fixed in version 2.6.0.","datePublished":"Sep 23, 2026, 5:59:16 PM","dateUpdated":"Sep 24, 2026, 2:15:04 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr\nhttps://github.com/openbao/openbao/pull/3389\nhttps://github.com/openbao/openbao/pull/3474\nhttps://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a\nhttps://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc\nhttps://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203\nhttps://github.com/openbao/openbao/releases/tag/v2.6.0\n","enisa_id":"EUVD-2026-85519\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Nov 11, 2026, 7:21:04 AM","vulnerabilityProduct":[{"id":"814ba9ec-4c97-3700-a033-23d847f2dcb8","product":{"name":"openbao","vendor":{"name":"openbao"}},"product_version":"\u003c 2.6.0"}],"vulnerabilityVendor":[{"id":"451dc10b-21d5-30a9-a600-efc8149cbee3","vendor":{"name":"openbao"}}]}}],"enisaIdAdvisory":[]}