CVE-2026-115361
Description
A flaw was found in OpenBao. When evaluating access control list (ACL) policies that combine broad wildcard permissions with specific identity-based denial rules, the application improperly drops explicit deny rules if the identity metadata includes wildcard or path segments. An authenticated user possessing matching identity metadata can exploit this issue to bypass access restrictions and access protected resources within the granted scope that should have been denied.
Statement
This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires highly specific policy configurations and identity metadata normally governed by trusted upstream identity providers. For an exposure to exist, an environment must configure overly permissive wildcard access paired with templated identity denial rules, while the identity metadata itself must contain wildcard or path elements. OpenBao is not included or supported in any Red Hat enterprise offerings, meaning Red Hat environments are not directly affected.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
