{"action":"Upgrade github.com/openbao/openbao to 0.0.0-20260713133043-f58d848c139e or later.","affected":[{"introduced":"0"},{"introduced":"0.1.0","last_affected":"1.1.5"}],"component":"github.com/openbao/openbao","cve_ids":["CVE-2026-63131"],"ecosystem":"Go","epss":0.00354,"exploited":false,"fixed_versions":["0.0.0-20260713133043-f58d848c139e"],"ghsa_id":"GHSA-xp3c-3jw3-4vcr","id":"tcs_01M5KFSH91GHH3F99ZRAVGDB5A","modified_at":"2026-10-01T20:55:56.794040591Z","published_at":"2026-09-22T20:36:56Z","references":["https://osv.dev/vulnerability/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-xp3c-3jw3-4vcr","url":"https://osv.dev/vulnerability/GHSA-xp3c-3jw3-4vcr"}],"summary":"OpenBao Skips Stricter Deny Policy for LIST operations"}