OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-63131 · CVE overview and exploitation status

EUVD-2026-85519

GHSA-xp3c-3jw3-4vcr

BIT-openbao-2026-63131

GO-2026-6579

cve-program · CVE-2026-63131

• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

euvd · EUVD-2026-85519

• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

nvd · CVE-2026-63131

• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/openbao/openbao/releases/tag/v2.6.0
• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr

osv · GHSA-xp3c-3jw3-4vcr

• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao
• https://github.com/openbao/openbao/releases/tag/v2.6.0

osv · GO-2026-6579

• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

No related changes are available here.