CVE-2026-71543 OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
Attackers can escalate privileges or issue unauthorized certificates by injecting wildcard characters into templated policies if user-controlled identity data is used.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71543?
CVE-2026-71543 is a high-severity vulnerability in openbao, published on 21 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-71543?
6 open source packages ship an affected version, including github.com/openbao/openbao and openbao.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openbao/openbao Go | All versions | 0.0.0-20260710001938-2d4ebafec5c5 |
github.com/openbao/openbao Go | All versions | 0.0.0-20260710001938-2d4ebafec5c5 |
github.com/openbao/openbao Go | All versions | 0.0.0-20260710001938-2d4ebafec5c5 |
github.com/openbao/openbao Go | From 0.1.0 to 1.1.5 | None |
github.com/openbao/openbao Go | From 0.1.0 to 1.1.5 | None |
openbao Bitnami | All versions | 2.6.0 |
How do I fix CVE-2026-71543?
Upgrade github.com/openbao/openbao to 0.0.0-20260710001938-2d4ebafec5c5 or later.
Is CVE-2026-71543 being exploited?
There is no known exploitation of CVE-2026-71543 in the wild and no public exploit code.
Sources
Also known as BIT-openbao-2026-71543, GHSA-59w7-v8rr-pr4p, GO-2026-6556, MINI-795r-7wqr-mm6q, MINI-xjj5-xwxq-6fc5.