---
id: CVE-2026-71543
title: OpenBao is an open source identity-based secrets management system
summary: >-
  OpenBao is an open source identity-based secrets management system. Prior to
  2.6.0, templated ACL, PKI, and SSH policies could substitute
  attacker-controlled identity data without rejecting syntax-significant
  characters. In ACL templated…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-863
vendor: openbao
product: github.com/openbao/openbao
affected:
  - github.com/openbao/openbao < 0.0.0-20260710001938-2d4ebafec5c5
  - 'github.com/openbao/openbao >= 0.1.0, <= 1.1.5'
patched:
  - github.com/openbao/openbao 0.0.0-20260710001938-2d4ebafec5c5
published: '2026-09-21'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T20:17:46.773'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71543'
references:
  - url: 'https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201'
    label: security-advisories@github.com
  - url: >-
      https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1
    label: security-advisories@github.com
  - url: >-
      https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3401'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3473'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.6.0'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71543'
  - url: 'https://github.com/advisories/GHSA-59w7-v8rr-pr4p'
  - url: 'https://github.com/openbao/openbao'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71543.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-71543'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-71543'
tags:
  - nvd
  - ghsa
  - go
  - osv
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00421
epssPercentile: 0.33829
aliases:
  - GHSA-59w7-v8rr-pr4p
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-25T19:26:34.934696Z'
cvssSource: vendor
scores:
  vendor: 7.2
  cna: 7.5
ingestedAt: '2026-09-21T15:19:25.701Z'
---

## Overview

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71543)

Affected packages:

- `github.com/openbao/openbao < 0.0.0-20260710001938-2d4ebafec5c5`
- `github.com/openbao/openbao >= 0.1.0, <= 1.1.5`

Patched in:

- `github.com/openbao/openbao 0.0.0-20260710001938-2d4ebafec5c5`

Source: https://github.com/advisories/GHSA-59w7-v8rr-pr4p

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71543.json)