MEDIUM GitHub
CVE-2026-63131
OpenBao Skips Stricter Deny Policy for LIST operations
## Impact
When a policy operator has written `capabilities = ["deny"]` on a path with a trailing wildcard but allowed a broader list operation (e.g., a `deny` on `secrets/metadata/restricted/*` but allowed `list` on `secrets/metadata/*`), OpenBao would incorrectly allow the operation. This did not impact other operation types.
## Patches
This has been patched in OpenBao v2.6.0.
Affected Products
- go/github.com/openbao/openbao < 0.0.0-20260713133043-f58d848c139e
- go/github.com/openbao/openbao >= 0.1.0, <= 1.1.5
References
- https://github.com/advisories/GHSA-xp3c-3jw3-4vcr
- https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
- https://github.com/openbao/openbao/pull/3389
- https://github.com/openbao/openbao/pull/3474
This medium severity vulnerability was published on 2026-09-22 via GitHub. Affected: go/github.com/openbao/openbao < 0.0.0-20260713133043-f58d848c139e, go/github.com/openbao/openbao >= 0.1.0, <= 1.1.5.
vulnfeed aggregates 13417 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.