CVE-2026-71543

Executive Summary

CVE-2026-71543 is a policy-template injection vulnerability in OpenBao, an open-source identity-based secrets management system, affecting all versions prior to 2.6.0. The flaw resides in templated ACL, PKI, and SSH policies that fail to reject syntax-significant characters (asterisk, plus sign, slash, comma) when substituting attacker-controlled identity data into policy templates. An authenticated user whose identity attributes flow into such templates can alter path-matching semantics, broaden certificate issuance to unauthorized domains, or inject unauthorized SSH principals, resulting in privilege escalation, unauthorized access, and unauthorized certificate issuance. Deployments that base templates solely on the randomly generated identity.entity.id value are not affected, which materially constrains the exposed population to configurations using user-controllable identity metadata (for example usernames, display names, or group-derived fields that users can freely modify).

Technical Analysis

OpenBao template policies allow administrators to interpolate identity-derived data into policy parameters at evaluation time. The vulnerability class here is CWE-863 (Incorrect Authorization) implemented through an injection into an authorization-decision input: the template engine performs substitution without validating or escaping characters that carry syntactic meaning in the destination grammar.

The NVD description identifies three distinct substitution surfaces and, for each, the specific metacharacter that alters meaning:

1. ACL templated policies — asterisks (*), plus signs (+), and slashes (/) could alter path matching. These characters are significant in path-glob and path-segment matching. Injecting them into a templated ACL path can widen a narrowly scoped grant into a broader matching rule, which is a direct path to privilege escalation across secret paths. This maps to T1078 — Valid Accounts, since no credential compromise is required; the attacker exercises a legitimately held identity whose attributes are attacker-controlled.

2. PKI allowed_uri_sans_template and allowed_domains policies — an asterisk could broaden certificate issuance to unauthorized domains. In these parameters, * functions as a wildcard. If an attacker-controlled template input lands in an allowed-domain or allowed-URI-SAN position and contains a wildcard, the issuing role may authorize names the administrator never intended, enabling unauthorized certificate issuance against attacker-chosen domains.

3. SSH allowed_users and allowed_domains policies — a comma could add unauthorized principals. Comma-delimited lists mean that an injected comma splits a single templated value into multiple entries, appending principals the policy author did not intend to authorize. That yields unauthorized SSH principal access.

Two structural facts sharpen the analysis. First, exploitation requires the deployment to use templated policy data that users can freely modify. This is a configuration-dependent precondition, not a universal property of OpenBao. Second, templates based on the randomly generated identity.entity.id value are explicitly not affected, because users cannot choose or edit that value. The practical dividing line is therefore attacker-controllable identity fields versus system-assigned random identifiers; the vulnerability lives on the attacker-controllable side of that line.

The flaw is pre-authentication-relevant only in the sense that it requires an authenticated identity. It is not a remote unauthenticated issue. The attack surface is the policy evaluation path inside the OpenBao server, not a network protocol parser, and there is no evidence in the provided data of a separate remote code execution primitive — the described impact is confined to authorization bypass, unauthorized cert issuance, and unauthorized SSH principal grants.

Insufficient technical detail is available to name specific template function names, source files, or internal evaluation routines; none appear in the NVD description, and none are asserted here.

Exploitation Scenarios

No public PoC is available (POC_STATUS: None). The attack chain below is inferred from the vulnerability class described in the NVD entry, and no specific code patterns, function names, or hypothetical endpoints are invented to fill gaps.

1. Reconnaissance and target identification. The attacker first determines whether a target OpenBao deployment uses templated policies whose interpolated fields derive from identity attributes the attacker can freely modify. This is often discoverable from organizational knowledge of the deployment, from documented policy templates, or from observing which identity fields appear in granted paths and subjects. Templates keyed exclusively on identity.entity.id are out of scope by design. An authenticated account on the deployment is a prerequisite.

2. Triggering the flaw class. The attacker sets or registers an identity attribute that is user-controllable and that the target's templated policy incorporates. Because the substitution path does not reject syntax-significant characters, whatever the attacker stores in that attribute is evaluated as policy syntax rather than as an opaque string.

3. Payload/execution at the vulnerability-class level. No crafted code is executed; the "payload" is the attacker-chosen value of a user-controllable identity attribute. Placement of the metacharacter determines the effect:

   • In an ACL template: embedding *, +, or / shifts path matching so that the rendered policy covers secret paths beyond the intended scope.
   • In a PKI template (allowed_uri_sans_template, allowed_domains): an embedded * widens the domain pattern so certificate issuance is authorized for domains the administrator did not permit.
   • In an SSH template (allowed_users, allowed_domains): an embedded , splits the rendered value into additional principals, granting SSH access the policy did not authorize. Each variant is a direct consequence of substituting unescaped metacharacters into a grammar where those characters are operators.

4. Post-exploitation impact. Successful exploitation yields privilege escalation through broadened ACL matching, unauthorized access to secrets or SSH targets, and unauthorized certificate issuance. Where ACL matching is widened, the attacker can read or act on secret paths outside their intended scope; where PKI policy is widened, the attacker can obtain certificates for unauthorized domains; where SSH policy is widened, the attacker can authenticate or be recognized as unauthorized principals. The description does not indicate persistence or lateral-movement primitives beyond the authorization outcomes themselves.

Impact Assessment

The NVD does not assign a CVSS score (Score: N/A; Vector: N/A), so no vendor-published subscores are quoted. The impact profile per the description is best characterized as remote, authenticated, and high-impact to confidentiality and integrity of authorization decisions, with no availability impact described:

• Confidentiality: High — broadened ACL path matching can expose secret paths and material outside the intended grant.
• Integrity: High — PKI allowed_domains/allowed_uri_sans_template broadening enables issuance of certificates that should never have been authorized, and SSH principal injection alters who is treated as an authorized user.
• Availability: None described.
• Attack vector: Network; privileges required: Low (an authenticated, low-privilege identity); user interaction: None; complexity: High, reflecting the configuration precondition that the deployment must use templated policy data the user can freely modify and must not rely on identity.entity.id.

Business impact concentrates on trust boundaries built on OpenBao-issued credentials: secrets management scope, internal PKI trust (a wrongly issued certificate can undermine TLS or mTLS trust chains and enable impersonation), and SSH access control. The blast radius is bounded by the population of deployments that use freely modifiable identity data in templates; deployments using only identity.entity.id-based templates are unaffected. Because templated ACL, PKI, and SSH policies may be used across multiple clusters, a single permissive template can propagate risk broadly within an organization. No evidence of in-the-wild exploitation, exploit code, or CISA KEV listing is present in the provided data; EPSS is not yet scored by FIRST.org, and no advisory has published a PoC.

Detection Guidance

Detection must target the authorization outcome rather than a network signature, since the "payload" is a stored identity attribute evaluated server-side. Instrument policy evaluation, identity-attribute mutation, secret-path access outside baseline, PKI issuance requests, and SSH principal/role grants.

Sigma Rule

title: OpenBao Policy Template Metacharacter Injection Attempt (CVE-2026-71543)
id: 3f9c1a72-5b4e-4d2a-9c11-7a8e6f0b2d31
status: experimental
description: Detects creation or modification of identity attributes / templated policy data containing syntax-significant metacharacters (*, +, /, comma) associated with CVE-2026-71543
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-71543
author: valtersit.com
date: 2026/01/01
logsource:
  product: openbao
  service: audit
detection:
  selection_event:
    operation:
      - "update"
      - "create"
    path|contains:
      - "identity"
      - "policy"
      - "pki"
      - "ssh"
  selection_metachar:
    request.data|contains:
      - "*"
      - "+"
      - ","
  condition: selection_event and selection_metachar
fields:
  - auth.display_name
  - auth.entity_id
  - request.path
  - request.data
falsepositives:
  - Legitimate administrative template authoring with intentional wildcards
  - Automated provisioning that encodes names containing plus or comma
level: medium
tags:
  - attack.t1078
  - cve.2026-71543

YARA Rule

rule CVE_2026_71543_OpenBao_Policy_Template_Injection
{
    meta:
        author = "valtersit.com"
        description = "Detects OpenBao templated policy artifacts using unescaped identity data with syntax-significant characters (CVE-2026-71543)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-71543"
        date = "2026-01-01"
        cve = "CVE-2026-71543"

    strings:
        $tpl_acl  = "templated" ascii nocase
        $pki1     = "allowed_uri_sans_template" ascii nocase
        $pki2     = "allowed_domains" ascii nocase
        $ssh1     = "allowed_users" ascii nocase
        $ssh2     = "allowed_domains" ascii nocase
        $ent      = "identity.entity.id" ascii nocase
        $star     = "*"
        $plus     = "+"
        $slash    = "/"
        $comma    = ","

    condition:
        (uint16(0) == 0x0A7B or true) and
        (
            ($tpl_acl and $star) or
            (($pki1 or $pki2) and $star) or
            (($ssh1 or $ssh2) and $comma)
        ) and
        not $ent
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-71543 OpenBao Policy Template Metacharacter Injection Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/v1/"; content:"identity"; distance:0; http.uri; content:"policy"; distance:0; http.request_body; content:"*"; http.request_body; content:"allowed_domains"; nocase; distance:0; classtype:attempted-user; reference:cve,2026-71543; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-71543; sid:202671543; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [any where event.category == "authentication" and event.action == "user_authenticated"]
  [any where
     (event.action in ("identity_update", "entity_update", "policy_write"))
     and (
        stringContains(to_string(openbao.request.body), "*") or
        stringContains(to_string(openbao.request.body), "+") or
        stringContains(to_string(openbao.request.body), ",")
     )
     and (
        stringContains(to_string(openbao.request.path), "policy") or
        stringContains(to_string(openbao.request.path), "pki") or
        stringContains(to_string(openbao.request.path), "ssh")
     )]

Splunk SPL Query

index=openbao sourcetype="openbao:audit"
| eval req_path=lower(coalesce('request.path', request_path, ""))
| eval req_data=coalesce('request.data', request_data, "")
| where (match(req_path, "identity|policy|pki|ssh"))
| where (match(req_data, "\\*") OR match(req_data, "\\+") OR match(req_data, ","))
| eval entity=coalesce('auth.entity_id', auth_entity_id, "")
| where entity != "" AND req_data NOT LIKE "%identity.entity.id%"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(req_path) as paths values(req_data) as payloads
        by 'auth.display_name' entity
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="openbao,cve-2026-71543,">
  <rule id="2026715" level="6">
    <decoded_as>json</decoded_as>
    <field name="type">response</field>
    <field name="request.path" type="pcre2">(?i)^/v1/(identity|policy|pki|ssh)</field>
    <field name="request.data" type="pcre2">[\*]|[+,]</field>
    <description>OpenBao templated policy data contains syntax-significant characters - CVE-2026-71543 policy template injection attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="2026716" level="10">
    <if_sid>2026715</if_sid>
    <field name="request.data" type="pcre2">(?i)(allowed_domains|allowed_uri_sans_template|allowed_users|templated)</field>
    <description>High confidence: OpenBao templated policy metacharacter injection targeting ACL/PKI/SSH templates - CVE-2026-71543</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, affected version list, or OSV package mapping has been published in the tracked sources; the only version guidance available is from the NVD description, which states the issue is fixed in OpenBao 2.6.0. Treat "2.6.0" as the vendor-reported target version and verify against the upstream project's release notes before relying on it.

1. Immediate mitigations (until upgrade is possible):

• Inventory all templated ACL, PKI (allowed_uri_sans_template, allowed_domains), and SSH (allowed_users, allowed_domains) policies and identify every template that interpolates identity data a user can freely modify. This set defines your exposure.
• Wherever feasible, convert affected templates to rely on the randomly generated identity.entity.id value, which the description states is not affected. Eliminate templates whose inputs are user-editable attributes (display names, usernames, self-service group or metadata fields).
• Treat any identity attribute that users can edit as untrusted input for policy purposes. If attribute self-editing is enabled for identities referenced by templated policies, restrict or disable that self-service capability.
• Audit PKI issuance and SSH principal grants for domains, URI SANs, and usernames that fall outside intended authorization, and review ACL paths that match more broadly than the policy author intended. Revoke any artifact issued through a broadened template.

2. Patch/upgrade steps:

• Upgrade to OpenBao 2.6.0 or later, per the NVD description. Because no patch evidence was available from tracked sources at the time both the NVD description was written and this report was generated, confirm the release artifact, checksum, and changelog entry directly from the upstream project before rollout, then validate that policy evaluation rejects the metacharacters described above.
• After upgrading, re-test each previously affected templated policy to confirm injected metacharacters no longer alter path matching, certificate issuance scope, or SSH principals.

3. Long-term hardening:

• Adopt least-privilege policy authoring: avoid wildcards and list-delimiters in any template value that can be influenced by an identity holder.
• Make identity attributes immutable where the relying policy depends on them; separate "user-editable profile" data from "authorization-relevant" identity data.
• Add CI/admission checks that reject *, +, /, and comma characters inside templated policy parameters unless explicitly justified and reviewed.
• Continuously monitor the policy-evaluation and audit stream with the detections above, and enable alerting on out-of-baseline secret-path access, anomalous certificate issuance, and new SSH principals.

References

• NVD — CVE-2026-71543: https://nvd.nist.gov/vuln/detail/CVE-2026-71543
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• OpenBao project repository and release notes (upstream advisory for 2.6.0): https://github.com/openbao/openbao
• CISA KEV catalog: not applicable — CVE-2026-71543 is not listed in CISA KEV as of this report.

No known threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. No public PoC, exploit code, or Nuclei template is known; EPSS has not yet scored this CVE, and no CVSS score has been assigned by NVD.