s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-63131

📛 CVE Title

OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

⬇ Download JSON

Description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.

Overview

State
PUBLISHED
Assigner (CNA)
GitHub_M
CVSS severity
MEDIUM
CVSS score
CVSS 6.0 / 10 6.0 6.0 / 10
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Effective score
6.0 / 10 MEDIUM source: CNA overview
CWE(s)
CWE-863
Reserved
2026-07-15
Published
2026-09-23 17:59 UTC
Last updated
2026-09-23 17:59 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63131.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-09-23 19:17:34 UTC
NVD last modified
2026-09-23 19:17:34 UTC

NVD / KEV / EPSS data refreshed 2026-09-24 04:37 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-85519
Assigner
GitHub_M
Published
Sep 23, 2026, 5:59:16 PM
Updated
Sep 23, 2026, 5:59:16 PM
EUVD base score (CVSS 4.0)
6.0 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EUVD-reported EPSS
0.0000
Vendors
openbao
Products
openbao (< 2.6.0)
Aliases
GHSA-xp3c-3jw3-4vcr

ENISA description: OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.

EUVD references (7)

Affected products (1)
VendorProductVersionsPlatforms
openbao openbao < 2.6.0 (affected) —

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (7)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (10)

  • Security Update Guide - Microsoft
    web:msrc.microsoft.com

    The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

    2026-09-24 11:52 UTC
  • Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva
    web:senserva.com

    Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

    2026-09-24 11:52 UTC
  • Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel ... - Ubuntu
    web:ubuntu.com

    A local privilege escalation (LPE) vulnerability affecting the Linux kernel has been publicly disclosed on April 29, 2026 . The vulnerability has been assigned CVE ID CVE - 2026 -31431 and is referred to as Copy Fail. The affected component is a kernel module that provides hardware-accelerated cryptographic functions: algif_aead. The vulnerability affects all Ubuntu releases before Resolute (26.04 ...

    2026-09-24 11:52 UTC
  • CVE-2026-31431: Copy Fail Mitigation | Linode Docs
    web:www.akamai.com

    CVE - 2026 -31431 ("Copy Fail") is a Linux vulnerability publicly disclosed on April 29, 2026 . This article shows how to identify vulnerable systems and apply mitigation .

    2026-09-24 11:52 UTC
  • April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike
    web:www.crowdstrike.com

    Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

    2026-09-24 11:52 UTC
  • Mitigating CVE-2026-31431 ("Copy Fail") in Docker Engine
    web:www.docker.com

    As of writing, the kernel patch is available on Debian ( CVE - 2026 -31431) and RHEL 9 (RHSB- 2026 -002) but not yet on Ubuntu. For users on distros that haven't shipped a kernel fix , upgrading Docker Engine is the mitigation you can apply today. Why you should read about Copy-Fail

    2026-09-24 11:52 UTC
  • CVE-2026-63131: openbao: OpenBao is an open source identity ... - Rapid7
    web:www.rapid7.com

    CVE-2026-63131 : openbao: OpenBao is an open source identity-based secrets management system. View severity, references, and remediation details from Rapid7.

    2026-09-24 11:52 UTC
  • CVE-2026-31431: How Red Hat Advanced Cluster Security and Red Hat ...
    web:www.redhat.com

    Learn about CVE - 2026 -31431, a Linux kernel issue affecting Red Hat OpenShift containers. Discover how Red Hat Advanced Cluster Security can help detect and respond to this exploit, and find out about remediation steps.

    2026-09-24 11:52 UTC
  • Proof-of-concept exploit available for Linux 'Copy Fail ... - Sophos
    web:www.sophos.com

    On April 29, 2026 , details about the ' Copy Fail ' vulnerability ( CVE - 2026 -31431) were publicly disclosed. This high-severity (CVSS score of 7.8) privilege escalation vulnerability impacts Linux distributions shipped since 2017. It allows an unprivileged local user to obtain root-level access on affected Linux systems by corrupting the kernel's in-memory page cache of a privileged binary ...

    2026-09-24 11:52 UTC
  • Vulnerabilities Resolved in Veeam Backup & Replication 13.0.1.2067
    web:www.veeam.com

    When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information.

    2026-09-24 11:52 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-63131.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "openbao",
          "vendor": "openbao",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T17:59:16.337Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr"
        },
        {
          "name": "https://github.com/openbao/openbao/pull/3389",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/pull/3389"
        },
        {
          "name": "https://github.com/openbao/openbao/pull/3474",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/pull/3474"
        },
        {
          "name": "https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a"
        },
        {
          "name": "https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc"
        },
        {
          "name": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203"
        },
        {
          "name": "https://github.com/openbao/openbao/releases/tag/v2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xp3c-3jw3-4vcr",
        "discovery": "UNKNOWN"
      },
      "title": "OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63131",
    "datePublished": "2026-09-23T17:59:16.337Z",
    "dateReserved": "2026-07-15T16:54:55.817Z",
    "dateUpdated": "2026-09-23T17:59:16.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}