CVE-2026-71543
Received Received - Intake

Privilege Escalation via Templated Policy Injection in OpenBao

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-71543
EUVD
EUVD-2026-83955

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openbao openbao 2.6.0
openbao openbao to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenBao (CVE-2026-71543) involves templated policies that allow attacker-controlled identity data to substitute wildcard characters without validation. In ACL policies, asterisks, plus signs, and slashes could alter path matching. In PKI policies, asterisks could broaden certificate issuance to unauthorized domains. In SSH policies, commas could add unauthorized principals. Exploitation requires user-modifiable templated policy data.

Detection Guidance

Check OpenBao version with 'openbao version' or 'vault version'. If version is below 2.6.0, the system is vulnerable. Review policy templates for ACL, PKI, and SSH engines to identify user-modifiable templates containing wildcards like *, +, /, or commas.

Impact Analysis

This vulnerability could allow privilege escalation, unauthorized access to sensitive data, or issuance of unauthorized TLS certificates. Attackers could manipulate paths, domains, or principals to gain broader access than intended. The impact includes potential data breaches, system compromise, and unauthorized certificate generation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles and HIPAA's security requirements for protected health information. Unauthorized certificate issuance or privilege escalation could result in data breaches, non-compliance with access control mandates, and potential legal penalties.

Mitigation Strategies

Upgrade OpenBao to version 2.6.0 or later immediately. Review and update all templated policies to remove wildcards. Disable user-modifiable templates if possible. Set allow_globs_in_substitutions=false and related flags to false in /sys/policy API.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71543. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart