CVE-2026-126309 — Openbao
HIGHCVE-2026-126309 is a high-severity (CVSS 7.1) External Control of File Name or Path vulnerability in openbao openbao. A fix is available — see the affected versions and patch details below.
OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers…
Description
OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.
Affected Products
openbaoopenbaoDetection & mitigation playbook
Vendor / applianceDetect
Inventory every openbao openbao deployment and check each version against the affected-products list above.
Fix
Apply the openbao openbao security patch or hotfix for CVE-2026-126309 on the affected version, following the vendor advisory for your exact build.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-126309 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.