{"id":"CVE-2026-63131","aliases":["GHSA-xp3c-3jw3-4vcr"],"title":"OpenBao Skips Stricter Deny Policy for LIST operations","summary":"OpenBao Skips Stricter Deny Policy for LIST operations","severity":"medium","cwe":["CWE-863"],"vendor":"openbao","product":"github.com/openbao/openbao","ecosystem":"go","affected":["github.com/openbao/openbao < 0.0.0-20260713133043-f58d848c139e","github.com/openbao/openbao >= 0.1.0, <= 1.1.5"],"patched":["github.com/openbao/openbao 0.0.0-20260713133043-f58d848c139e"],"published":"2026-09-22","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:36:57Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-xp3c-3jw3-4vcr","references":[{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr"},{"url":"https://github.com/openbao/openbao/pull/3389"},{"url":"https://github.com/openbao/openbao/pull/3474"},{"url":"https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a"},{"url":"https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc"},{"url":"https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203"},{"url":"https://github.com/openbao/openbao/releases/tag/v2.6.0"},{"url":"https://github.com/advisories/GHSA-xp3c-3jw3-4vcr"}],"tags":["ghsa","go"],"ingestedAt":"2026-09-22T21:11:40.316Z","slug":"CVE-2026-63131","body":"## Overview\n\n## Impact\n\nWhen a policy operator has written `capabilities = [\"deny\"]` on a path with a trailing wildcard but allowed a broader list operation (e.g., a `deny` on `secrets/metadata/restricted/*` but allowed `list` on `secrets/metadata/*`), OpenBao would incorrectly allow the operation. This did not impact other operation types.\n\n## Patches\n\nThis has been patched in OpenBao v2.6.0.\n\n## Affected packages\n\n- `github.com/openbao/openbao < 0.0.0-20260713133043-f58d848c139e`\n- `github.com/openbao/openbao >= 0.1.0, <= 1.1.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/openbao/openbao 0.0.0-20260713133043-f58d848c139e`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}