CVE-2026-71543: OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
OpenBao’s Templated Policies Allow Privilege Escalation via Wildcard Characters
References
- github.com/advisories/GHSA-59w7-v8rr-pr4p
- github.com/hashicorp/vault/blob/main/CHANGELOG.md
- github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1
- github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc
- github.com/openbao/openbao/pull/3401
- github.com/openbao/openbao/pull/3473
- github.com/openbao/openbao/releases/tag/v2.6.0
- github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p
- nvd.nist.gov/vuln/detail/CVE-2026-71543
Code Behaviors & Features
Detect and mitigate CVE-2026-71543 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →