CVE-2026-63131 openbao CVE debrief

Who should care

Defenders managing OpenBao deployments, especially those with LIST operations and ACL configurations, should assess exposure and prioritize upgrading to version 2.6.0 or later. They should also review ACL configurations to prevent unauthorized LIST operations and verify OpenBao deployments.

Why it matters

Defenders should prioritize verifying and upgrading OpenBao to version 2.6.0 or later, assess exposure in their environment, and review ACL configurations to prevent unauthorized LIST operations.

• Verify and upgrade OpenBao to version 2.6.0 or later
• Assess and update ACL configurations to prevent unauthorized LIST operations
• Review environment for exposure to this issue

Technical summary

The issue in OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [deny] for a LIST operation, potentially allowing listing of denied paths. This issue allows listing a denied path if a parent path permitted LIST and a child path was denied. The issue is fixed in version 2.6.0. Defenders should verify OpenBao deployments, assess exposure, and prioritize upgrading to version 2.6.0 or later if using a version prior to 2.6.0, and assess exposure in their environment.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenBao version 2.6.0 or later if using a version prior to 2.6.0, and assess exposure in their environment.

Recommended defensive actions

• Verify OpenBao version and upgrade to 2.6.0 or later if necessary
• Assess exposure in the environment
• Review and update ACL configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• technicalSummary

Evidence notes

The CVE record and source references provide details on the issue, including its description, affected versions, and fixed version. OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [deny] for a LIST operation. This issue allows listing a denied path if a parent path permitted LIST and a child path was denied. The issue is fixed in version 2.6.0. Defenders should verify OpenBao deployments, assess exposure, and prioritize upgrading to version

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.