Answer in brief
CVE-2026-63131 records a Medium severity vulnerability in OpenBao Skips Stricter Deny Policy for LIST operations. The current sources do not mark it as known exploited. The current feed maps github.com/openbao/openbao (go), github.com/openbao/openbao (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps github.com/openbao/openbao (go), github.com/openbao/openbao (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/openbao/openbaogo | <0.0.0-20260713133043-f58d848c139e | 0.0.0-20260713133043-f58d848c139e |
| github.com/openbao/openbaogo | >=0.1.0,<=1.1.5 | Not reported |
Published upstream
Sep 22, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Sep 22, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Sep 22, 2026
## Impact When a policy operator has written `capabilities = ["deny"]` on a path with a trailing wildcard but allowed a broader list operation (e.g., a `deny` on `secrets/metadata/restricted/*` but allowed `list` on `secrets/metadata/*`), OpenBao would incorrectly allow the operation. This did not impact other operation types. ## Patches This has been patched in OpenBao v2.6.0.
Quoted source text, attributed separately from HOL analysis.