OpenBao before version 2.6.3 allows an ACL bypass that silently discards explicit deny rules when wildcard identity metadata templates are used within grants. An attacker whose identity metadata contains wildcard or path elements can therefore reach paths that should be protected by a deny rule, effectively gaining unauthorized access. The vulnerability is a clear instance of improper handling of policy rules and is identified as CWE-266 and CWE-863.

Systems running OpenBao versions earlier than 2.6.3 are affected. The vulnerability applies to all deployments of the openbao product where wildcard identity metadata is enabled in ACL policies.

The CVSS score of 2.1 indicates low severity. The EPSS score of 0.00205 suggests a very low chance of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack likely requires the ability to manipulate identity metadata within an OpenBao client or service, and when exploited an attacker can reach resources that should be denied, potentially leading to data exposure within the affected system.