EUVD-2026-83955
GHSA-59w7-v8rr-pr4p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H and PR:L because it needs an authenticated user able to edit template-feeding identity data plus a non-default templated-policy config; C/I:H for unauthorized access and cert/principal forgery; A:N as no availability impact is described.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.
AnalysisAI
OpenBao versions prior to 2.6.0 fail to reject syntax-significant characters when templated identity data is substituted into ACL, PKI, and SSH policies, allowing an authenticated principal who can write that identity data to broaden path matching, obtain certificates for unauthorized domains, or add unauthorized SSH principals. Exploitation is gated on a non-default configuration: the policy must use templates that substitute attacker-modifiable identity metadata (for example {{identity.entity.metadata.domains}} or {{identity.entity.metadata.sans}}), and the attacker must already hold the capability to update that identity record (such as update on identity/entity), consistent with the assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a non-default configuration where OpenBao ACL, PKI, or SSH policies use TEMPLATED values that substitute identity data the attacker can freely modify - specifically entity metadata such as {{identity.entity.metadata.domains}} or {{identity.entity.metadata.sans}}. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authorization-bypass (CWE-863) in OpenBao's templated policy engine, but its real-world risk is moderate and heavily gated, not the broad 7.5 the CVSS 4.0 headline suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenBao 2.6.0 or later (vendor-released patch: 2.6.0), available at https://github.com/openbao/openbao/releases/tag/v2.6.0, which adopts the fixes from pull requests 3401 and 3473 (commits 2d4ebafec5c524408b3d4ac1198df909cb7ac8c1 and e516ce508e1481504cadbfbf62052364339093bc) and adds the new allow_globs_in_substitutions role option, defaulting to false, so wildcard characters in substituted identity data are rejected. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all OpenBao deployments and identify every ACL, PKI, and SSH policy template that substitutes identity metadata (for example {{identity.entity.metadata.domains}} or {{identity.entity.metadata.sans}}); treat any that do as exposed, and determine which users and service accounts currently hold update capability on identity/entity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated re
Session cross-wiring in SUSE NeuVector before 5.6.1 allows an unauthenticated remote attacker to obtain another user's a
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today