CVE-2026-126309
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.