{"action":"Upgrade github.com/openbao/openbao to 0.0.0-20260713133043-f58d848c139e or later.","affected":[{"introduced":"0"}],"component":"github.com/openbao/openbao","cve_ids":["CVE-2026-63131"],"ecosystem":"Go","epss":0.00354,"exploited":false,"fixed_versions":["0.0.0-20260713133043-f58d848c139e"],"ghsa_id":"GHSA-xp3c-3jw3-4vcr","id":"tcs_01M5KGVJV338K80A72DZJD9N08","modified_at":"2026-10-01T20:55:56.794040591Z","published_at":"2026-10-01T20:23:38Z","references":["https://osv.dev/vulnerability/GO-2026-6579","https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6579","url":"https://osv.dev/vulnerability/GO-2026-6579"}],"summary":"OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao"}