CVE-2026-126311
MEDIUM
NVD
CVSS Score
5.8
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users.