CVE-2026-115366
Description
A flaw was found in OpenBao. An improper authorization vulnerability in the plugin catalog interface allows an authenticated user with privileged access in a child namespace to modify system-wide plugin configurations. Because access to these endpoints is not restricted to the root namespace, an attacker can delete, invalidate, or manipulate plugin registrations, leading to a Denial of Service (DoS).
Statement
Red Hat has evaluated this vulnerability as a Moderate severity impact because exploitation is constrained to a denial of service and requires an attacker to already possess authenticated, privileged credentials within a child namespace. Arbitrary code execution is prevented because plugin registration requires pre-existing binaries on the host filesystem that match predefined cryptographic checksums. Consequently, an attacker cannot execute arbitrary unauthorized code, and the operational blast radius is limited to disrupting plugin availability across namespaces.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
