WS-2026-0077

OpenBao's sys/plugins/catalog update, delete and read handlers lacked a root-namespace check, so a privileged token scoped to a child namespace could register, modify or remove plugin catalog entries that are global to the whole server. Affects OpenBao 2.3.0-beta20250528 through 2.6.2 since...