CVE-2026-115366

low

Description

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.

References

https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-missing-root-namespace-enforcement-in-plugin-catalog-apis

https://github.com/openbao/openbao/security/advisories/GHSA-cg72-x35g-xfp8

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108291

Details

Source: Mitre, NVD

Published: 2026-10-22

Updated: 2026-10-22

Risk Information

CVSS v2

Base Score: 2.1

Vector: CVSS2#AV:N/AC:H/Au:S/C:N/I:N/A:P

Severity: Low

CVSS v3

Base Score: 2.6

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L

Severity: Low

CVSS v4

Base Score: 2

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Severity: Low