~ / search / GHSA-xp3c-3jw3-4vcr

GHSA-xp3c-3jw3-4vcr

OpenBao Skips Stricter Deny Policy for LIST operations

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-63131

Packages

EcosystemPackageAffectedFixed in
Go github.com/openbao/openbao < 0.0.0-20260713133043-f58d848c139e 0.0.0-20260713133043-f58d848c139e
Go github.com/openbao/openbao >= 0.1.0, <= 1.1.5 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact When a policy operator has written `capabilities = ["deny"]` on a path with a trailing wildcard but allowed a broader list operation (e.g., a `deny` on `secrets/metadata/restricted/*` but allowed `list` on `secrets/metadata/*`), OpenBao would incorrectly allow the operation. This did not impact other operation types. ## Patches This has been patched in OpenBao v2.6.0.

References

External links from the advisory. They lead to third-party sites.