{"affected":[{"defaultStatus":"unaffected","ecosystem":"golang","packageName":"github.com/openbao/openbao/v2","product":"openbao","source":"CNA: VulnCheck","vendor":"openbao","versions":[{"lessThan":"2.6.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.6.5","versionType":"semver"},{"lessThan":"2.7.2","status":"affected","version":"2.7.0","versionType":"semver"},{"status":"unaffected","version":"2.7.2","versionType":"semver"}]}],"cveId":"CVE-2026-126311","cwes":["CWE-155"],"description":"OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.6,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","version":"4.0"},{"score":5.8,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},{"score":4.6,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":5.8,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1794565056807,"publishedAt":1794562578274,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-h76r-48x5-36hg"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-wildcard-principals-in-ssh-certificates-via-identity-templates"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-h76r-48x5-36hg"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-wildcard-principals-in-ssh-certificates-via-identity-templates"}],"remediation":[],"revision":"75c154b1feb7c5d0aa902b0ff06630f0ec530504cc7811d6cb9af38e53267feb","sources":[{"modifiedAt":1794562578274,"name":"CNA: VulnCheck","retrievedAt":1794564596596,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126311"},{"modifiedAt":1794565056807,"name":"NVD","retrievedAt":1794572187924,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126311"}],"ssvc":null,"status":"published","title":"OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates","updatedAt":1794572187924}