CVE WATCH / VULNERABILITY DETAIL
CVE-2026-126312
HIGHCVSS 7.1NVD feed
Published 13 November 2026 · tracked since 14 November 2026
Description
OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-126400 LOW 3.7
- CVE-2026-126384 HIGH 7.5
- CVE-2026-126383 HIGH 8.2
- CVE-2026-126381 MEDIUM 6.3
- CVE-2026-126380 CRITICAL 9.1
- CVE-2026-126378 CRITICAL 9.1
- CVE-2026-126377 HIGH 8.1
- CVE-2026-126374 MEDIUM 4.3
- CVE-2026-126372 HIGH 8.8
- CVE-2026-126370 HIGH 8.8