HIGHCVSS v3.1 7.1Vulnerability
CVE-2026-126312
OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00418
- Cvss severity
- HIGH
- Cvss score
- 7.1
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 7.1
- Cvss version
- 3.1
- Cve id
- CVE-2026-126312
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
- Published at
- 2026-11-13T10:17:36.973
- Last modified
- 2026-11-13T10:17:36.973
- Epss percentile
- 0.36683
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph