Medium severity · published Oct 22, 2026
CVE-2026-115365
OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
New
6.6
CVSS
0.3%
EPSS
No
On KEV
Description
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openbao · openbao
2.3.0 before 2.6.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115365
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115365
github.com
https://github.com/openbao/openbao/security/advisories/GHSA-mjch-vcw3-hhmf
www.vulncheck.com
https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-incorrect-authorization-via-policy-cache-namespace-traversal
More from openbao
9.8
CVE-2024-2048
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate
9.2
CVE-2026-63132
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
9.1
CVE-2025-54997
OpenBao: Privileged Operator May Execute Code on the Underlying Host
8.8
CVE-2024-7594
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default
8.3
CVE-2026-33757
OpenBao lacks user confirmation for OIDC direct callback mode