Description
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.
Published: 2026-10-22
Score: 2 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

OpenBao versions 2.3.0 to 2.6.2 have an improper authorization flaw that allows privileged child‑namespace tokens to access the /v1/sys/plugins/catalog/* API endpoint without being restricted to the root namespace. Attackers can delete existing plugin registrations, create malformed ones, or register plugins through a child namespace's sys/ mount, which can break service functionality and cause denial of service.

Affected Systems

The vulnerability affects the OpenBao product from the vendor OpenBao, specifically all releases from 2.3.0 up to 2.6.2, inclusive. These versions expose the plugin catalog API without enforcing root‑namespace ownership checks.

Risk and Exploitability

The CVSS score is 2, indicating a low severity impact. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. However, for an application that employs child‑namespace tokens with sufficient privileges, the flaw could be exploited by issuing API calls to /v1/sys/plugins/catalog/*, resulting in unauthorized plugin configuration changes and potential service interruption.

Generated by OpenCVE AI on October 23, 2026 at 03:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OpenBao to version 2.6.3 or later to eliminate the missing root namespace enforcement bug.
  • If immediate upgrade is not feasible, restrict child‑namespace tokens from accessing the /v1/sys/plugins/catalog/* endpoint by updating plugin‑catalog and sys/ mount policies to allow only root‑namespace access.
  • Monitor audit logs for unauthorized plugin catalog modifications and review plugin registrations regularly to detect any tampering.

Generated by OpenCVE AI on October 23, 2026 at 03:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.
Title OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs
First Time appeared Openbao
Openbao openbao
Weaknesses CWE-863
CPEs cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*
Vendors & Products Openbao
Openbao openbao
References
Metrics cvssV3_1

{'score': 2.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Openbao Openbao
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T19:13:39.752Z

Reserved: 2026-10-22T11:21:20.779Z

Link: CVE-2026-115366

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T19:17:43.100

Modified: 2026-10-22T19:17:43.100

Link: CVE-2026-115366

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T04:15:18Z

Weaknesses