Is CVE-2026-63131 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63131 being exploited in the wild.

How severe is CVE-2026-63131?

Medium severity, with a CVSS score of 4, published 23 September 2026.

Which products and versions are affected?

github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260713133043-f58d848c139e, SEMVER:introduced=0,fixed=0.0.0-20260713133043-f58d848c139e,introduced=0.1.0; OpenBao = 0.1.0, <= 1.1.5).

Is there a fix for CVE-2026-63131?

Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260713133043-f58d848c139e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63131 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63131?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63131: OpenBao authorization bypass in policy enforcement for LIST operations

Q: Is there a fix for CVE-2026-63131?

Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260713133043-f58d848c139e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-63131 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-63131?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63131 · Severity: medium · CVSS 4 · Published 2026-09-23

OpenBao is a secrets management and encryption system used to protect sensitive data in organizations. When an administrator has configured deny policies with wildcards on certain paths, OpenBao incorrectly allows LIST operations that should be blocked by stricter deny rules. An authenticated attacker could exploit this to access restricted secrets they should not be able to list, potentially exposing sensitive information.

Technologies: github.com/openbao/openbao (Go), OpenBao. Vendors: Go, OpenBao.

Quick answers

Is CVE-2026-63131 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63131 being exploited in the wild.
How severe is CVE-2026-63131?: Medium severity, with a CVSS score of 4, published 23 September 2026.
Which products and versions are affected?: github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260713133043-f58d848c139e, SEMVER:introduced=0,fixed=0.0.0-20260713133043-f58d848c139e,introduced=0.1.0; OpenBao < v2.6.0 (including versions < 0.0.0-20260713133043-f58d848c139e and >= 0.1.0, <= 1.1.5).
Is there a fix for CVE-2026-63131?: Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260713133043-f58d848c139e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63131 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63131?: Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openbao/openbao (Go): upgrade to 0.0.0-20260713133043-f58d848c139e or later
```
go get github.com/openbao/openbao@v0.0.0-20260713133043-f58d848c139e
```

Technical details

This is an authorization bypass vulnerability caused by incorrect policy evaluation logic (CWE-863: Incorrect Authorization). When a deny policy is configured with a trailing wildcard on a specific path (e.g., `deny` on `secrets/metadata/restricted/*`) but a broader list capability is allowed on a parent path (e.g., `list` on `secrets/metadata/*`), OpenBao's policy engine incorrectly prioritizes the broader allow rule over the stricter deny rule for LIST operations only. This flaw does not affect other operation types. An authenticated user with network access to OpenBao can perform LIST operations on restricted paths they should not have access to. The vulnerability has been patched in OpenBao v2.6.0.

Affected products

OpenBao OpenBao < v2.6.0 (including versions < 0.0.0-20260713133043-f58d848c139e and >= 0.1.0, <= 1.1.5)

Identifiers

CVE-2026-63131
BIT-OPENBAO-2026-63131
GHSA-xp3c-3jw3-4vcr
GO-2026-6579

Timeline

2026-07-14: disclosed
2026-09-22: advisory
2026-09-22: patched: OpenBao v2.6.0 released with fix

References

https://api.github.com/users/babakizo420

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.