{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126312", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:16:44.443Z", "datePublished": "2026-11-13T09:36:17.584Z", "dateUpdated": "2026-11-13T09:36:17.584Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-13T09:36:17.584Z"}, "datePublic": "2026-10-26T00:00:00.000Z", "title": "OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths", "descriptions": [{"lang": "en", "value": "OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Handling of Case Sensitivity", "cweId": "CWE-178", "type": "CWE"}]}], "affected": [{"vendor": "openbao", "product": "openbao", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao/v2", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.6.5"}, {"version": "2.6.5", "status": "unaffected", "versionType": "semver"}, {"version": "2.7.0", "status": "affected", "versionType": "semver", "lessThan": "2.7.2"}, {"version": "2.7.2", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "openbao", "product": "openbao", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao-plugins/auth/ldap", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "0.2.0"}, {"version": "0.2.0", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "openbao", "product": "openbao", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao-plugins/auth/radius", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "0.2.0"}, {"version": "0.2.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.6.5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.7.0", "versionEndExcluding": "2.7.2"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.2.0"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.2.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-736f-82w7-hj22)"}, {"name": "VulnCheck Advisory: OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths"}], "credits": [{"lang": "en", "value": "gn00295120", "type": "reporter"}, {"lang": "en", "value": "datosh", "type": "reporter"}, {"lang": "en", "value": "omar152002", "type": "reporter"}, {"lang": "en", "value": "ria-labs-security", "type": "reporter"}, {"lang": "en", "value": "HAN-BAMBO", "type": "reporter"}, {"lang": "en", "value": "cipherboy", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao/v2", "product": "openbao", "vendor": "openbao", "versions": [{"lessThan": "2.6.5", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.6.5", "versionType": "semver"}, {"lessThan": "2.7.2", "status": "affected", "version": "2.7.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.7.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao-plugins/auth/ldap", "product": "openbao", "vendor": "openbao", "versions": [{"lessThan": "0.2.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "0.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/openbao/openbao-plugins/auth/radius", "product": "openbao", "vendor": "openbao", "versions": [{"lessThan": "0.2.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "0.2.0", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules."}], "id": "CVE-2026-126312", "lastModified": "2026-11-13T10:17:36.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.5, "source": "[email protected]", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-11-13T10:17:36.973", "references": [{"source": "[email protected]", "url": "https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22"}, {"source": "[email protected]", "url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-178"}], "source": "[email protected]", "type": "Primary"}]}

{}

{}