EUVD-2026-108291

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

CVE-2026-115366

Versions 2.3.0 through 2.6.3 of OpenBao are vulnerable to an improper authorization flaw. The issue arises because the /v1/sys/plugins/catalog/* API endpoint is not restricted to the root namespace, allowing privileged child-namespace tokens to modify plugin registrations. An attacker can leverag...