Executive brief
OpenBao, a secrets management and encryption platform, supports templated policies that use placeholders to grant fine-grained access control. An attacker can exploit this feature by injecting wildcard characters into user-controllable data, bypassing intended access restrictions and escalating privileges across ACL policies, PKI certificate issuance, and SSH certificate generation. This affects deployments where users can modify data used in policy templates, potentially allowing unauthorized access to sensitive resources and certificate issuance.
Technical details
The vulnerability exists in OpenBao's templated policy system across three engines: ACL policies (vulnerable to `*`, `+`, `/` wildcards), PKI secrets engine (vulnerable to `*` in allowed_uri_sans_template and allowed_domains), and SSH secrets engine (vulnerable to `,` in allowed_users and allowed_domains). When a policy template uses placeholder substitution and the substituted data is user-controllable, an attacker can inject wildcard or delimiter characters to expand access beyond intended scope. For example, injecting `*` in a username template allows matching all entries instead of a single user. The attack requires an attacker to control the data used in template evaluation, typically through username selection or similar user-configurable attributes. Patches are available in OpenBao v2.6.0.
Affected products
- OpenBao OpenBao before 2.6.0
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: OpenBao v2.6.0