What is GHSA-w7x3-3wf8-3w6w?

GHSA-w7x3-3wf8-3w6w is a security advisory published by GitHub Security Advisories with High severity. OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL...

Which CVE IDs does GHSA-w7x3-3wf8-3w6w cover?

GHSA-w7x3-3wf8-3w6w covers the following CVE IDs: CVE-2026-115365. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w7x3-3wf8-3w6w?

GHSA-w7x3-3wf8-3w6w has a CVSS v3 base score of 6.6, published by GitHub Security Advisories.

GHSA-w7x3-3wf8-3w6wHighCVSS 6.6

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-115365 →

📋 Description

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.

🔗 References (4)

https://github.com/openbao/openbao/security/advisories/GHSA-mjch-vcw3-hhmf
https://nvd.nist.gov/vuln/detail/CVE-2026-115365
https://www.vulncheck.com/advisories/openbao-2.3.0-before-2.6.3-incorrect-authorization-via-policy-cache-namespace-traversal
https://github.com/advisories/GHSA-w7x3-3wf8-3w6w