{"cve":"CVE-2026-63131","nvd":{"published":"2026-09-23T19:17:34.497","modified":"2026-09-29T19:06:32.333","status":"Deferred","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.0},"cvss_v3":null,"cwes":["CWE-863"],"references":["https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-63131","score":0.00484,"percentile":0.41686,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-xp3c-3jw3-4vcr","url":"https://osv.dev/vulnerability/GHSA-xp3c-3jw3-4vcr","summary":"OpenBao Skips Stricter Deny Policy for LIST operations","modified":"2026-10-01T20:55:56.794040591Z","packages":[{"ecosystem":"Go","name":"github.com/openbao/openbao","purl":"pkg:golang/github.com/openbao/openbao","ranges":["<0.0.0-20260713133043-f58d848c139e"],"fixed":["0.0.0-20260713133043-f58d848c139e"]},{"ecosystem":"Go","name":"github.com/openbao/openbao","purl":"pkg:golang/github.com/openbao/openbao","ranges":[">=0.1.0 <=1.1.5"],"fixed":[]}]},{"id":"GO-2026-6579","url":"https://osv.dev/vulnerability/GO-2026-6579","summary":"OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao","modified":"2026-10-01T20:55:56.794040591Z","packages":[{"ecosystem":"Go","name":"github.com/openbao/openbao","purl":"pkg:golang/github.com/openbao/openbao","ranges":["<0.0.0-20260713133043-f58d848c139e",">=0.1.0"],"fixed":["0.0.0-20260713133043-f58d848c139e"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}