CVE-2026-115361

A flaw was found in OpenBao. When evaluating access control list ACL policies that combine broad wildcard permissions with specific identity-based denial rules, the application improperly drops explicit deny rules if the identity metadata includes wildcard or path segments. An authenticated user...