18 matches found
CVE-2026-115361
A flaw was found in OpenBao. When evaluating access control list ACL policies that combine broad wildcard permissions with specific identity-based denial rules, the application improperly drops explicit deny rules if the identity metadata includes wildcard or path segments. An authenticated user...
vault-cve-2026-5006-audit
CVE-2026-5006 toolkit HCSEC-2026-32 Two tools for working through the Vault templated-policy slash-injection vulnerability: an interactive walkthrough for explaining and scoping the issue, and an audit script that checks a live cluster and writes the findings to Markdown...
BIT-OPENBAO-2026-115361 OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader...
PT-2026-132453
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...
Incorrect Authorization
Overview github.com/openbao/openbao/sdk/v2/helper/identitytpl is a None Affected versions of this package are vulnerable to Incorrect Authorization. in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...
CVE-2026-115361
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader...
CVE-2026-115361 OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader...
CVE-2026-115361
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader...
EUVD-2026-108286
OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader...
PT-2026-121541
Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3 Description An ACL bypass occurs when explicit deny rules based on forbidden identity metadata templates within wildcard grants are silently dropped. This allows attackers with identity metadata containing...
OpenBao authorization issue vulnerability
Versions prior to OpenBao 2.6.3 contain an authorization issue vulnerability stemming from ACL bypass. In wildcard authorization, explicit denial rules based on identity metadata templates are silently discarded; attackers possessing identity metadata containing wildcards or path segments can thu...
CVE-2026-10079 Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...