Description
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.
Published: 2026-10-22
Score: 2 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

OpenBao versions 2.3.0 to 2.6.2 have an improper authorization flaw that allows privileged child‑namespace tokens to access the /v1/sys/plugins/catalog/* API endpoint without being restricted to the root namespace. Attackers can delete existing plugin registrations, create malformed ones, or register plugins through a child namespace's sys/ mount, which can break service functionality and cause denial of service.

Affected Systems

The vulnerability affects the OpenBao product from the vendor OpenBao, specifically all releases from 2.3.0 up to 2.6.2, inclusive. These versions expose the plugin catalog API without enforcing root‑namespace ownership checks.

Risk and Exploitability

The CVSS score is 2, indicating a low severity impact. The EPSS score of less than 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. This improper authorization flaw (CWE-425, CWE-863) allows privileged child‑namespace tokens to modify plugin registrations. However, for an application that employs child‑namespace tokens with sufficient privileges, the flaw could be exploited by issuing API calls to /v1/sys/plugins/catalog/*, resulting in unauthorized plugin configuration changes and potential service interruption.

Generated by OpenCVE AI on November 4, 2026 at 11:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OpenBao to version 2.6.3 or later to eliminate the missing root namespace enforcement bug.
  • If immediate upgrade is not feasible, restrict child‑namespace tokens from accessing the /v1/sys/plugins/catalog/* endpoint by updating plugin‑catalog and sys/ mount policies to allow only root‑namespace access.
  • Monitor audit logs for unauthorized plugin catalog modifications and review plugin registrations regularly to detect any tampering.

Generated by OpenCVE AI on November 4, 2026 at 11:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-425
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 27 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.
Title OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs
First Time appeared Openbao
Openbao openbao
Weaknesses CWE-863
CPEs cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*
Vendors & Products Openbao
Openbao openbao
References
Metrics cvssV3_1

{'score': 2.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Openbao Openbao
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T19:38:30.184Z

Reserved: 2026-10-22T11:21:20.779Z

Link: CVE-2026-115366

cve-icon Vulnrichment

Updated: 2026-10-26T19:31:20.939Z

cve-icon NVD

Status : Deferred

Published: 2026-10-22T19:17:43.100

Modified: 2026-10-26T20:17:50.553

Link: CVE-2026-115366

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-22T19:13:39Z

Links: CVE-2026-115366 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T11:30:10Z

Weaknesses
  • CWE-425

    Direct Request ('Forced Browsing')

  • CWE-863

    Incorrect Authorization