Executive brief
OpenBao is a secrets management and encryption system used to protect sensitive data in organizations. When an administrator has configured deny policies with wildcards on certain paths, OpenBao incorrectly allows LIST operations that should be blocked by stricter deny rules. An authenticated attacker could exploit this to access restricted secrets they should not be able to list, potentially exposing sensitive information.
Technical details
This is an authorization bypass vulnerability caused by incorrect policy evaluation logic (CWE-863: Incorrect Authorization). When a deny policy is configured with a trailing wildcard on a specific path (e.g., `deny` on `secrets/metadata/restricted/*`) but a broader list capability is allowed on a parent path (e.g., `list` on `secrets/metadata/*`), OpenBao's policy engine incorrectly prioritizes the broader allow rule over the stricter deny rule for LIST operations only. This flaw does not affect other operation types. An authenticated user with network access to OpenBao can perform LIST operations on restricted paths they should not have access to. The vulnerability has been patched in OpenBao v2.6.0.
Affected products
- OpenBao OpenBao < v2.6.0 (including versions < 0.0.0-20260713133043-f58d848c139e and >= 0.1.0, <= 1.1.5)
Timeline
- 2026-07-14: disclosed
- 2026-09-22: advisory
- 2026-09-22: patched: OpenBao v2.6.0 released with fix