{"id":"CVE-2026-126312","aliases":[],"cve":{"records":[{"id":"CVE-2026-126312","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-10T20:16:44.443Z","published":"2026-11-13T09:36:17.584Z","modified":"2026-11-13T09:36:17.584Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:36:17.584Z"}],"references":[{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-178","description":"Improper Handling of Case Sensitivity","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","versionEndExcluding":"2.6.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","versionStartIncluding":"2.7.0","versionEndExcluding":"2.7.2"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","versionEndExcluding":"0.2.0"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","versionEndExcluding":"0.2.0"}]}]}]}],"prioritization":[]},"title":"OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.","score":7.6,"severity":"high","published":"2026-11-13T09:36:17.584Z","modified":"2026-11-13T09:36:17.584Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"openbao","name":"openbao","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2.6.5","versionType":"semver"},{"version":"2.6.5","status":"unaffected","versionType":"semver"},{"version":"2.7.0","status":"affected","lessThan":"2.7.2","versionType":"semver"},{"version":"2.7.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/openbao/openbao/v2","packageIdentity":{"ecosystem":"Go","name":"github.com/openbao/openbao/v2"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-126312"},{"vendor":"openbao","name":"openbao","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.2.0","versionType":"semver"},{"version":"0.2.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/openbao/openbao-plugins/auth/ldap","packageIdentity":{"ecosystem":"Go","name":"github.com/openbao/openbao-plugins/auth/ldap"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-126312"},{"vendor":"openbao","name":"openbao","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.2.0","versionType":"semver"},{"version":"0.2.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/openbao/openbao-plugins/auth/radius","packageIdentity":{"ecosystem":"Go","name":"github.com/openbao/openbao-plugins/auth/radius"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-126312"}],"remediation":[],"references":["https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22","https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths"],"sources":[{"name":"CVE","id":"CVE-2026-126312","modified":"2026-11-13T09:36:17.584Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-126312"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":7.6},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","score":7.1}],"sourceAffected":[],"observedAt":"2026-11-13T13:25:48.661Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:30:31.194Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-13T14:30:50.666Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T14:35:35.483Z","attemptedAt":"2026-11-13T14:35:35.483Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T14:35:32.357Z","attemptedAt":"2026-11-13T14:35:32.357Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T14:35:35.483Z","attemptedAt":"2026-11-13T14:35:35.483Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-125208","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125208","modified":"Nov 13, 2026, 9:36:17 AM","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T14:35:32.357Z"},{"source":"FIRST EPSS","id":"CVE-2026-126312","url":"https://www.first.org/epss/","probability":0.00418,"percentile":0.36683,"date":"2026-11-13","checkedAt":"2026-11-13T14:35:35.483Z"},{"source":"GitHub Advisory Database","id":"GHSA-p45h-4w5c-x9r9","url":"https://github.com/advisories/GHSA-p45h-4w5c-x9r9","modified":"2026-11-13T12:31:24Z","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","checkedAt":"2026-11-13T14:35:35.483Z"}],"aiSummary":{"text":"OpenBao before 2.6.5 and 2.7.2, and certain plugins before 0.2.0, have an ACL bypass vulnerability due to implicit path canonicalization, allowing authenticated attackers to evade ACL deny rules. Affected versions include OpenBao 2.6.x before 2.6.5 and 2.7.x before 2.7.2. The weakness is caused by improper handling of case sensitivity.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T13:36:36.330Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-126312"}]}}