https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 07:08:09 +0000 https://db.gcve.eu/vuln/cve-2026-126311 <p><strong>Affected:</strong> openbao</p> <p>OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject &#39;*&#39; to obtain SSH certificates valid for multiple hosts or users.</p> <p><strong>Affected:</strong> openbao</p> <p>OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject &#39;*&#39; to obtain SSH certificates valid for multiple hosts or users.</p> https://db.gcve.eu/vuln/cve-2026-126311