A critical authorization flaw in OpenBao versions prior to 2.6.0 allows authenticated attackers to escalate privileges and bypass security policies through crafted identity data.

This is an incorrect authorization vulnerability (CWE-863) where templated policies fail to reject syntax-significant characters in attacker-controlled identity data. The flaw requires an authenticated user with high privileges to influence the templated policy data, leading to unauthorized path matching, certificate issuance, or principal assignment.

The ability to bypass ACLs and issue unauthorized certificates poses a severe risk to the integrity of an organization's secrets management infrastructure. Because this vulnerability allows for privilege escalation and unauthorized access to sensitive credentials, it could lead to widespread data compromise or complete system takeover. With a CVSS score of 7.5, this issue represents a significant risk to organizational security posture.

Immediate Action: Upgrade all OpenBao instances to version 2.6.0 or higher to implement the necessary input sanitization for policy templates.

Proactive Monitoring: Review access logs and audit trails for unusual policy modifications or unexpected certificate issuance events that deviate from established operational baselines.

Compensating Controls: Restrict the ability of users to modify templated policy data and move toward using identity.entity.id values, which are not susceptible to this specific injection vector.

Public Exploit Available: Unknown

Given the potential for privilege escalation and unauthorized certificate issuance, administrators should treat this vulnerability with high priority. Organizations utilizing OpenBao must audit their current policy templates to identify any user-modifiable inputs and prioritize the deployment of version 2.6.0 to eliminate the underlying authorization weakness.