---
id: CVE-2026-115361
title: OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
summary: >-
  OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops
  explicit deny rules based on forbidden identity metadata templates within
  wildcard grants. Attackers whose identity metadata contains wildcard or path
  segments…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-863
vendor: openbao
product: openbao
affected:
  - openbao < 2.6.3
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:13:36.151Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115361'
references:
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-hr5j-3j78-4vh2'
    label: GitHub Security Advisory (GHSA-hr5j-3j78-4vh2)
  - url: >-
      https://www.vulncheck.com/advisories/openbao-before-2.6.3-acl-bypass-via-dropped-templated-policy-denial
    label: >-
      VulnCheck Advisory: OpenBao before 2.6.3 ACL Bypass via Dropped Templated
      Policy Denial
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.399Z'
---

## Overview

OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.

## Affected

- `openbao < 2.6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.