CVE-2026-115365
Description
A flaw was found in OpenBao. An authenticated attacker can bypass authorization boundaries by assigning specially crafted policy names to tokens, allowing the tokens to reference cached Access Control List (ACL) policies from other namespaces. This can allow the attacker to gain unauthorized privileges within other namespaces, including the root namespace, resulting in privilege escalation.
Statement
Red Hat Product Security has rated this vulnerability as Moderate because successful exploitation requires elevated privileges to create or assign tokens with crafted policy names, alongside the specific timing requirement that targeted policies reside concurrently in the in-memory cache during token creation and use. In typical enterprise multi-tenant deployments, non-administrative users do not possess permissions to bind arbitrary policy identifiers across tenancy boundaries. As a result, the prerequisite access level and narrow operating conditions substantially reduce the operational exposure to cross-namespace privilege escalation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
