CVE-2026-71543High· 7.2▾ TwilightOpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
none → high
0.2%
0.2% → 0.4%
— → 7.2
Last analysed / modified upstream
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/openbao/openbao < 0.0.0-20260710001938-2d4ebafec5c5github.com/openbao/openbao >= 0.1.0, <= 1.1.5Patched in:
github.com/openbao/openbao 0.0.0-20260710001938-2d4ebafec5c5Source: https://github.com/advisories/GHSA-59w7-v8rr-pr4p
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63131Medium· 6.0OpenBao is an open source identity-based secrets management system
CVE-2026-55774Low· 2.1OpenBao is an open source identity-based secrets management system
CVE-2026-77285Low· 2.4OpenBao is an open source identity-based secrets management system
CVE-2026-63132Critical· 9.2OpenBao is an open source identity-based secrets management system
CVE-2026-55770Medium· 6.8OpenBao is an open source identity-based secrets management system
CVE-2026-55775Low· 2.3OpenBao is an open source identity-based secrets management system