CVE-2026-115365

OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

State: Published
Severity: 7.5 High
Published: Oct 22, 2026
Updated: Oct 22, 2026
Reserved: Oct 22, 2026

Description

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.

Scores

CVSS	Score	Vector	Source
4.0	7.5 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	6.6 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
openbaoopenbao	2.3.0 to before 2.6.3Affected 2.6.3Not affected

References

GitHub Security Advisory (GHSA-mjch-vcw3-hhmf)vendor-advisory
VulnCheck Advisory: OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversalthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.