OpenBao before version 2.6.3 allows a policy bypass that silently discards explicit deny rules when wildcard identity metadata templates are used within grants. Attackers whose identity metadata contains wildcard or path elements can therefore reach paths that should be protected by a deny rule, effectively gaining unauthorized access. The vulnerability is a clear instance of improper handling of policy rules and is identified as CWE-863, an authorization bypass.

Systems running OpenBao versions earlier than 2.6.3 are affected. The vulnerability applies to all deployments of the openbao product where wildcard identity metadata is enabled in ACL policies.

The CVSS score of 2.1 indicates low severity, and there is no EPSS score available; the vulnerability is not listed in CISA's KEV catalog. The attack likely requires the ability to manipulate identity metadata in the context of an OpenBao client or service, making the likelihood of exploitation low but not negligible. When exploited, an attacker can access resources that should be denied, potentially leading to data exposure within the affected system.