CVE-2026-115366
CVE-2026-115366 · OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.
CVSS 2.0 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
openbao
- Versions
- ≥ 2.3.0, < 2.6.3: Affected (semver)
- 2.6.3: Not affected (semver)
Update to 2.6.3