OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-63131 · Microsoft / collected KEV context

EUVD-2026-85519

GHSA-xp3c-3jw3-4vcr

BIT-openbao-2026-63131

GO-2026-6579

cve-program · CVE-2026-63131

• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

euvd · EUVD-2026-85519

• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

nvd · CVE-2026-63131

• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/openbao/openbao/releases/tag/v2.6.0
• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr

osv · GHSA-xp3c-3jw3-4vcr

• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao
• https://github.com/openbao/openbao/releases/tag/v2.6.0

osv · GO-2026-6579

• https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
• https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a
• https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc
• https://github.com/openbao/openbao/pull/3389
• https://github.com/openbao/openbao/pull/3474
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

No related operational record is retained in the current change model.