Vulnerability-Lookup

CVE-2026-71543 (GCVE-0-2026-71543)

Vulnerability from cvelistv5 – Published: 2026-09-21 15:03 – Updated: 2026-09-25 19:26

Title

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

Summary

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.

Severity

7.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 19:26 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7711 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/openbao/openbao/security/advis…	x_refsource_CONFIRM
https://github.com/openbao/openbao/pull/3401	x_refsource_MISC
https://github.com/openbao/openbao/pull/3473	x_refsource_MISC
https://github.com/openbao/openbao/commit/2d4ebaf…	x_refsource_MISC
https://github.com/openbao/openbao/commit/e516ce5…	x_refsource_MISC
https://github.com/hashicorp/vault/blob/main/CHAN…	x_refsource_MISC
https://github.com/openbao/openbao/releases/tag/v2.6.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
openbao	openbao	Affected: <2.6.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71543",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T19:26:34.934696Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T19:26:50.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openbao",
          "vendor": "openbao",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T15:03:59.159Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p"
        },
        {
          "name": "https://github.com/openbao/openbao/pull/3401",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/pull/3401"
        },
        {
          "name": "https://github.com/openbao/openbao/pull/3473",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/pull/3473"
        },
        {
          "name": "https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1"
        },
        {
          "name": "https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc"
        },
        {
          "name": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201"
        },
        {
          "name": "https://github.com/openbao/openbao/releases/tag/v2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-59w7-v8rr-pr4p",
        "discovery": "UNKNOWN"
      },
      "title": "OpenBao\u0027s Templated Policies Allow Privilege Escalation via Wildcard Characters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71543",
    "datePublished": "2026-09-21T15:03:59.159Z",
    "dateReserved": "2026-08-06T21:24:15.375Z",
    "dateUpdated": "2026-09-25T19:26:50.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71543",
      "date": "2026-10-15",
      "epss": "0.00421",
      "percentile": "0.34924"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "openbao",
                "vendor": "openbao",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c2.6.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0."
          }
        ],
        "id": "CVE-2026-71543",
        "lastModified": "2026-09-25T20:17:46.773",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-71543",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T19:26:34.934696Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-21T15:17:31.173",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openbao/openbao/pull/3401"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openbao/openbao/pull/3473"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-09-23T11:59:04+00:00",
      "cve": "CVE-2026-71543",
      "id": "CVE-2026-71543",
      "initial_release_date": "2026-09-21T15:03:59.159000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openbao: OpenBao: Privilege Escalation via Wildcard Characters in Templated Policies",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71543.json",
      "version": "3"
    }
  }
}

bit-openbao-2026-71543

Vulnerability from bitnami_vulndb

Published

2026-09-29 08:53

Modified

2026-09-29 09:14

Summary

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "openbao",
        "purl": "pkg:bitnami/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71543"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:openbao:openbao:*:*:*:*:*:go:*:*"
    ],
    "severity": "High"
  },
  "details": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.",
  "id": "BIT-openbao-2026-71543",
  "modified": "2026-09-29T09:14:51.928Z",
  "published": "2026-09-29T08:53:02.630Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/pull/3401"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/pull/3473"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71543"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "OpenBao\u0027s Templated Policies Allow Privilege Escalation via Wildcard Characters"
}

FKIE_CVE-2026-71543

Vulnerability from fkie_nvd - Published: 2026-09-21 15:17 - Updated: 2026-09-25 20:17

Severity

7.5 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201
	security-advisories@github.com	https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1
	security-advisories@github.com	https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc
	security-advisories@github.com	https://github.com/openbao/openbao/pull/3401
	security-advisories@github.com	https://github.com/openbao/openbao/pull/3473
	security-advisories@github.com	https://github.com/openbao/openbao/releases/tag/v2.6.0
	security-advisories@github.com	https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "openbao",
          "vendor": "openbao",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c2.6.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0."
    }
  ],
  "id": "CVE-2026-71543",
  "lastModified": "2026-09-25T20:17:46.773",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-71543",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-25T19:26:34.934696Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-21T15:17:31.173",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/pull/3401"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/pull/3473"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-59W7-V8RR-PR4P

Vulnerability from github – Published: 2026-09-22 20:36 – Updated: 2026-09-22 20:36

Summary

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

Details

Impact

ACL Policies

OpenBao supports "templated polices": Policies with placeholders that are replaced at evaluation time.

This allows you to write a single policy which e.g. grants user "alice" access to all entries in a key value engine prefixed with alice/ while granting "bob" access to bob/, "carol" access to carol/, etc.

If the data used in the template can be controlled by an attacker (e.g. your system allows the user to freely select their username) and "globbing" characters are considered valid ( e.g. * is a valid username) they will be able to escalate their privileges.

The problematic characters are *, + and /.

PKI Secrets Engine `allowed_uri_sans_template` and `allowed_domains` Polices

The PKI secrets engine allows you to limit the "common names" a user can requests a TLS certificate for. Similar to the ACL polices this allows you to restrict e.g. "alice" to alice.example.com, "bob" to bob.example.com, etc. via templates.

Again, if an attacker can control this data freely, they can trick the PKI engine into using e.g. the *.example.com glob effectively allowing them to issue certificates for any subdomain of example.com

The problematic character in this case is *.

SSH Secrets Engine `allowed_users` and `allowed_domains` Polices

The SSH secrets engine allows you to limit the "principal" a user can request as SSH certificate for. Similar to ACL and PKI, this allows templates.

The problematic character in this case is , as the template result is split at all commas and each entry will be allowed.

Am I affected?

You are affected, if a) you use a templated policy (ACL, PKI or SSH) and b) your users can modify data used by your template freely.

If you can guarantee that the data used in your templates will never contain the problematic characters, you are not affected. For example, if you use {{ identity.entity.id }} in your policy, you are not affected, because identity.entity.id is randomly generated by OpenBao.

Even with this vulnerability patched: Using user controllable data in your policies is probably not the best idea.

Patches

All three have been patched in OpenBao v2.6.0.

Severity

7.5 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260710001938-2d4ebafec5c5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "last_affected": "1.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71543"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:36:49Z",
    "nvd_published_at": "2026-09-21T15:17:31Z",
    "severity": "HIGH"
  },
  "details": "## Impact\n\n### ACL Policies\n\nOpenBao supports \"templated polices\": Policies with placeholders that are replaced at evaluation time.\n\nThis allows you to write a single policy which e.g. grants user \"alice\" access to all entries in a key value engine prefixed with `alice/` while granting \"bob\" access to `bob/`, \"carol\" access to `carol/`, etc.\n\nIf the data used in the template can be controlled by an attacker (e.g. your system allows the user to freely select their username) and \"globbing\" characters are considered valid ( e.g. `*` is a valid username) they will be able to escalate their privileges.\n\nThe problematic characters are `*`, `+` and `/`.\n\n### PKI Secrets Engine `allowed_uri_sans_template` and `allowed_domains` Polices\n\nThe PKI secrets engine allows you to limit the \"common names\" a user can requests a TLS certificate for. Similar to the ACL polices this allows you to restrict e.g. \"alice\" to  `alice.example.com`, \"bob\" to  `bob.example.com`, etc. via templates.\n\nAgain, if an attacker can control this data freely, they can trick the PKI engine into using e.g. the `*.example.com` glob effectively allowing them to issue certificates for any subdomain of `example.com`\n\nThe problematic character in this case is `*`.\n\n### SSH Secrets Engine `allowed_users` and `allowed_domains` Polices\n\nThe SSH secrets engine allows you to limit the \"principal\" a user can request as SSH certificate for. Similar to ACL and PKI, this allows templates.\n\nThe problematic character in this case is `,` as the template result is split at all commas and each entry will be allowed.\n\n## Am I affected?\n\nYou are affected, if a) you use a templated policy (ACL, PKI or SSH) and b) your users can modify data used by your template freely.\n\nIf you can guarantee that the data used in your templates will never contain the problematic characters, you are not affected. For example, if you use `{{ identity.entity.id }}` in your policy, you are not affected, because `identity.entity.id` is randomly generated by OpenBao.\n\n\n\nEven with this vulnerability patched: Using user controllable data in your policies is probably not the best idea.\n\n## Patches\n\nAll three have been patched in OpenBao v2.6.0.",
  "id": "GHSA-59w7-v8rr-pr4p",
  "modified": "2026-09-22T20:36:49Z",
  "published": "2026-09-22T20:36:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71543"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/pull/3401"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/pull/3473"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openbao/openbao"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": " OpenBao\u0027s Templated Policies Allow Privilege Escalation via Wildcard Characters"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-71543 (GCVE-0-2026-71543)

bit-openbao-2026-71543

Vulnerability from bitnami_vulndb

FKIE_CVE-2026-71543

GHSA-59W7-V8RR-PR4P

Impact

ACL Policies

PKI Secrets Engine allowed_uri_sans_template and allowed_domains Polices

SSH Secrets Engine allowed_users and allowed_domains Polices

Am I affected?

Patches

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

PKI Secrets Engine `allowed_uri_sans_template` and `allowed_domains` Polices

SSH Secrets Engine `allowed_users` and `allowed_domains` Polices