{"affected":[{"defaultStatus":"unaffected","ecosystem":"golang","packageName":"github.com/openbao/openbao/v2","product":"openbao","source":"CNA: VulnCheck","vendor":"openbao","versions":[{"lessThan":"2.6.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.6.5","versionType":"semver"},{"lessThan":"2.7.2","status":"affected","version":"2.7.0","versionType":"semver"},{"status":"unaffected","version":"2.7.2","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"golang","packageName":"github.com/openbao/openbao-plugins/auth/ldap","product":"openbao","source":"CNA: VulnCheck","vendor":"openbao","versions":[{"lessThan":"0.2.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"golang","packageName":"github.com/openbao/openbao-plugins/auth/radius","product":"openbao","source":"CNA: VulnCheck","vendor":"openbao","versions":[{"lessThan":"0.2.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.2.0","versionType":"semver"}]}],"cveId":"CVE-2026-126312","cwes":["CWE-178"],"description":"OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.6,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.1,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},{"score":7.6,"severity":"high","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":7.1,"severity":"high","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1794565056973,"publishedAt":1794562577584,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths"}],"remediation":[],"revision":"4cd599232318330147a8a7a77699b067931749e68fbaeccf21a94c91c12bf141","sources":[{"modifiedAt":1794562577584,"name":"CNA: VulnCheck","retrievedAt":1794564597723,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126312"},{"modifiedAt":1794565056973,"name":"NVD","retrievedAt":1794572188098,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126312"}],"ssvc":null,"status":"published","title":"OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths","updatedAt":1794572188098}