CVE-2026-63131 OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)
Attackers can bypass ACL deny rules to list secrets in restricted paths by exploiting a trailing-slash evaluation flaw in OpenBao.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63131?
CVE-2026-63131 is a medium-severity missing authorization vulnerability in openbao, published on 23 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-63131?
6 open source packages ship an affected version, including github.com/openbao/openbao and openbao.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openbao/openbao Go | All versions | 0.0.0-20260713133043-f58d848c139e |
github.com/openbao/openbao Go | All versions | 0.0.0-20260713133043-f58d848c139e |
github.com/openbao/openbao Go | All versions | 0.0.0-20260713133043-f58d848c139e |
github.com/openbao/openbao Go | From 0.1.0 to 1.1.5 | None |
github.com/openbao/openbao Go | From 0.1.0 to 1.1.5 | None |
openbao Bitnami | All versions | 2.6.0 |
How do I fix CVE-2026-63131?
Upgrade github.com/openbao/openbao to 0.0.0-20260713133043-f58d848c139e or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-63131 being exploited?
There is no known exploitation of CVE-2026-63131 in the wild and no public exploit code.
Sources
Also known as BIT-openbao-2026-63131, GHSA-xp3c-3jw3-4vcr, GO-2026-6579, MINI-4pp6-rmp3-w8pr, MINI-x2pg-37p3-6728.