Impact OpenBao's request handling mechanism did not validate operation type when non-HTTP API requests were created, such as with inline authentication and workflows. Certain internal operation types would result in token issues when handled as a login request. While these operations would by default not specify policies, identity entity resolution would still occur, potentially leading to attached policies on this token. All existing community-maintained plugins did not perform policy resolution on any internal operations and thus token scope would be limited. ### Patches This has been patched in v2.6.2. ### References Gia Bui (@yabeow) from Calif.io reported the inline auth problem and expanded impact was disclosed by @cipherboy.