A vulnerability in OpenBao allows authenticated users to bypass intended access restrictions and list sensitive paths, potentially exposing internal structure.

This is an incorrect authorization flaw (CWE-863) within the vault/policy/acl.go component. It occurs because the system incorrectly evaluates broader wildcard ACL grants before more specific denied paths during a LIST operation, requiring the attacker to be an authenticated user.

The ability to list restricted paths undermines the principle of least privilege within an identity-based secrets management system. While the CVSS score of 6.0 (Medium) reflects that this is not a full remote code execution, unauthorized visibility into restricted secret paths can lead to information disclosure regarding the organization's infrastructure and secret hierarchy, significantly aiding an attacker in planning further lateral movement.

Immediate Action: Upgrade OpenBao to version 2.6.0 or later, which contains the corrected ACL evaluation logic.

Proactive Monitoring: Review access logs for unusual patterns of LIST requests, particularly those originating from user accounts that should not have visibility into specific sensitive paths.

Compensating Controls: Ensure that strict policy design is enforced and, where possible, audit existing ACLs to ensure they do not rely solely on wildcard grants that might overlap with restricted paths.

Public Exploit Available: Unknown

Given that OpenBao serves as a central pillar for secrets management, any authorization bypass is a significant security concern. Administrators should prioritize the upgrade to version 2.6.0 during the next maintenance window to ensure that ACLs are evaluated correctly and that sensitive path information is protected from unauthorized discovery.