HIGH7.5
GO-2026-6556
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters in github.com/openbao/openbao
Quick fix
GO-2026-6556 — github.com/openbao/openbao: upgrade to the fixed version with the command below.
go get github.com/openbao/openbao@v0.0.0-20260710001938-2d4ebafec5c5Details
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters in github.com/openbao/openbao
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/openbao/openbao
Introduced in:
0Fixed in: 0.0.0-20260710001938-2d4ebafec5c5Fix
go get github.com/openbao/openbao@v0.0.0-20260710001938-2d4ebafec5c5References
- https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-71543[ADVISORY]
- https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1[FIX]
- https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc[FIX]
- https://github.com/openbao/openbao/pull/3401[FIX]
- https://github.com/openbao/openbao/pull/3473[FIX]
- https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201[WEB]
- https://github.com/openbao/openbao/releases/tag/v2.6.0[WEB]