Is CVE-2026-115361 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115361 being exploited in the wild.

How severe is CVE-2026-115361?

Medium severity, with a CVSS score of 4.1, published 22 October 2026.

Is there a fix for CVE-2026-115361?

Yes: fixed in 2.6.3, 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115361 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115361?

Check whether you run OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115361: OpenBao ACL bypass in policy denial evaluation

CVE-2026-115361 · Severity: medium · CVSS 4.1 · Published 2026-10-22

OpenBao is a secrets management system that controls who can access sensitive data through policy rules. This vulnerability allows attackers with specific identity metadata to bypass access denial rules and reach secrets they should not be able to access, even when those rules explicitly restrict broader access grants.

Technologies: OpenBao. Vendors: OpenBao.

Quick answers

Is CVE-2026-115361 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115361 being exploited in the wild.
How severe is CVE-2026-115361?: Medium severity, with a CVSS score of 4.1, published 22 October 2026.
Which products and versions are affected?: OpenBao before 2.6.3.
Is there a fix for CVE-2026-115361?: Yes: fixed in 2.6.3, 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115361 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115361?: Check whether you run OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.6.3, 2.7.0

Technical details

OpenBao silently drops explicit deny policy rules when they contain forbidden identity metadata templates within wildcard-granted scopes. Attackers whose identity metadata includes wildcard or path segments can exploit this to access restricted paths within a broader wildcard-granted scope. The vulnerability requires high privileges and high attack complexity but is remotely exploitable over the network.

Affected products

OpenBao OpenBao before 2.6.3

Timeline

2026-09-23: disclosed
2026-10-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.