CVE-2026-115365 openbao CVE debrief

Who should care

Defenders responsible for OpenBao deployments, particularly those using versions 2.3.0 to 2.6.2, should assess their exposure and take necessary actions. This includes verifying current ACL policy cache configurations, reviewing compensating controls, and prioritizing upgrades to version 2.6.3 or later. Security teams and vulnerability management teams should also be aware of the potential impact and take steps to mitigate it.

Why it matters

Defenders should care about CVE-2026-115365 because it allows attackers to gain capabilities of cached policies in other namespaces, potentially leading to unauthorized access and privilege escalation. Those responsible for OpenBao deployments, particularly versions 2.3.0 to 2.6.2, should verify their exposure, review ACL policy cache configurations, and prioritize upgrading to version 2.6.3 or later.

• Potential unauthorized access to sensitive resources
• Possible escalation of privileges
• Need for verification of current ACL policy cache configurations
• Priority on upgrading to OpenBao version 2.6.3 or later

Technical summary

The vulnerability in OpenBao's ACL policy cache allows tokens to reference policies from arbitrary namespaces, potentially leading to unauthorized access. This incorrect authorization vulnerability impacts OpenBao deployments using versions 2.3.0 to 2.6.2. Defenders should verify their current ACL policy cache configurations and prioritize upgrading to version 2.6.3 or later. The vulnerability can be mitigated by reviewing and updating ACL policy cache configurations and monitoring for potential exploitation attempts.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenBao version 2.6.3 or later, and review their current ACL policy cache configurations.

Recommended defensive actions

• Verify OpenBao version and upgrade to 2.6.3 or later if necessary
• Review and update ACL policy cache configurations
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is needed to confirm affected versions and potential impact. OpenBao deployments using versions 2.3.0 to 2.6.2 should be verified for exposure. Defenders should review ACL policy cache configurations and consider upgrading to version 2.6.3 or later. The vulnerability allows tokens to reference policies from arbitrary namespaces, potentially leading to unauthorized access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.