Openbao

CVE-2026-126312: OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP

CVE-2026-126312 Nov 13, 2026 Source: Vendor

OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-126312

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

5 lines

Showing 1–5 of 5

CVE-2026-126312 BR2026-0000-048131 unclaimed

Credited as gn00295120

CVE-2026-126312 BR2026-0000-048132 unclaimed

Credited as datosh

CVE-2026-126312 BR2026-0000-048133 unclaimed

Credited as omar152002

CVE-2026-126312 BR2026-0000-048134 unclaimed

Credited as ria-labs-security

CVE-2026-126312 BR2026-0000-048135 unclaimed

Credited as HAN-BAMBO