CVE-2026-71543: OpenBao Privilege Escalation Vulnerability

CVE-2026-71543 Overview

CVE-2026-71543 is an authorization vulnerability [CWE-863] in OpenBao, an open source identity-based secrets management system. Versions prior to 2.6.0 fail to reject syntax-significant characters when substituting attacker-controlled identity data into templated ACL, PKI, and SSH policies. An attacker who can modify identity metadata used by these templates can inject wildcard characters, commas, or slashes to alter policy semantics. The result is privilege escalation, unauthorized secret access, and unauthorized certificate issuance. The issue is fixed in OpenBao 2.6.0.

Critical Impact
Injection of characters such as *, +, /, and , into templated policies can broaden ACL path matching, expand PKI certificate issuance to unauthorized domains, and add unauthorized SSH principals.

Affected Products

OpenBao versions prior to 2.6.0
Deployments using templated ACL policies with user-modifiable identity data
Deployments using PKI allowed_uri_sans_template or allowed_domains templates, and SSH allowed_users or allowed_domains templates

Discovery Timeline

2026-09-21 - CVE-2026-71543 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-71543

Vulnerability Analysis

OpenBao supports templated policies that substitute identity data, such as entity metadata or alias names, into ACL paths and PKI or SSH role parameters at evaluation time. Prior to version 2.6.0, the substitution logic did not sanitize characters that carry semantic meaning in downstream matching engines. This flaw is classified as Incorrect Authorization [CWE-863].

In ACL templated policies, injected *, +, or / characters change path matching, expanding the effective scope of a granted capability. In PKI roles, an injected * in a substituted value causes the glob-based domain matcher to accept certificate requests for unauthorized domains. In SSH roles, injecting a comma into a substituted value appends additional principals to allowed_users or allowed_domains.

Exploitation requires that the deployment uses templated policy data the attacker can freely modify, such as writable entity metadata. Templates based on the randomly generated identity.entity.id value are not affected.

Root Cause

The template renderer treated identity attributes as opaque strings and passed them directly to downstream matchers without escaping. Downstream components including the ACL path matcher, the PKI go-glob domain matcher, and the SSH principal parser interpreted metacharacters in the substituted values. The fix introduces an explicit allow_globs_in_substitutions role parameter and integrates the identitytpl helper so operators must opt in to permitting wildcard characters in substituted values.

Attack Vector

An authenticated attacker with permission to modify their own entity metadata (or an alias attribute used by a template) sets a value containing injection characters. When OpenBao evaluates a templated ACL, PKI, or SSH policy, the malicious substring alters policy semantics. The attacker then requests a secret, issues a certificate, or opens an SSH session that the intended policy would have denied.

// Security patch in builtin/logical/pki/path_roles.go
// Fix: ACL templates allow wildcard chars in substitution (#3401)

			Description: `If set, Allowed domains can be specified using identity template policies.
				Non-templated domains are also permitted.`,
		},
		"allow_globs_in_substitutions": {
			Type:     framework.TypeBool,
			Required: true,
			Description: `If set and templating is enabled, the values substituted in
				for allowed_uri_sans_template and allowed_domains template expression
				might contain a wildcard characters ('*' and '+'). This can enable
				injection attacks. Only use this, if the data used by the templates
				is trusted.`,
		},
		"allow_bare_domains": {
			Type:     framework.TypeBool,
			Required: true,

Source: OpenBao Commit 2d4ebaf

Detection Methods for CVE-2026-71543

Indicators of Compromise

Entity or alias metadata values containing *, +, /, or , characters where such characters are not expected by application logic.
PKI certificate issuance events for domains that do not correspond to any statically configured allowed_domains entry.
SSH sessions authenticated under principals that are not present in the role's static allowed_users list.
Successful reads or writes against secret paths that a user's non-templated policies would not permit.

Detection Strategies

Audit OpenBao entity and alias metadata for values containing policy metacharacters, focusing on fields referenced by templated policies.
Correlate identity/entity write events with subsequent pki/issue, ssh/creds, or secret read requests from the same token.
Review audit logs for policy evaluation results where the rendered path or role parameter differs materially from the template source.

Monitoring Recommendations

Enable OpenBao's file or socket audit device and forward events to a centralized log platform for correlation.
Alert on entity metadata changes performed by non-administrative tokens, particularly when the value contains glob or delimiter characters.
Track PKI and SSH issuance rates per role and investigate anomalous spikes tied to a single entity.

How to Mitigate CVE-2026-71543

Immediate Actions Required

Upgrade OpenBao to version 2.6.0 or later, which introduces the allow_globs_in_substitutions role parameter and hardens substitution.
Inventory all ACL, PKI, and SSH policies that use identity templating and identify those referencing user-modifiable attributes.
Restrict write access to identity/entity and identity/entity-alias endpoints to trusted administrators only.
Rotate any certificates or SSH credentials issued through templated roles during the exposure window.

Patch Information

The fix is delivered in OpenBao Release v2.6.0 via pull requests #3401 and #3473. Full details are documented in the OpenBao Security Advisory GHSA-59w7-v8rr-pr4p.

Workarounds

Replace user-controllable template variables with the randomly generated identity.entity.id, which is not affected.
Remove or rewrite templated ACL, PKI, and SSH policies until the upgrade is deployed.
Enforce input validation at the identity provider or metadata write path to reject values containing *, +, /, or ,.

bash

# Configuration example: after upgrade to 2.6.0, keep glob substitution disabled
# unless template inputs are fully trusted.
bao write pki/roles/example \
  allowed_domains_template=true \
  allow_globs_in_substitutions=false \
  allowed_domains='{{identity.entity.metadata.department}}.example.com'