Impact Several locations within OpenBao allow access to resources via non-canonical names: - Policies and workflows allow case-insensitive, whitespace-trimmed, and path-simplified access to a tree of resources - Certificate and Kubernetes authentication's roles, Userpass's user definitions, PKI seceret's "default" key and issuer references are case-insensitive. When an ACL policy grants access via a broad wildcard and specific deny grants are used to exclude specific resources of the above types, an attacker can bypass the denial and access resources under the wildcard grant by using any of the names which do not match the explicit shape of the denial. This vulnerability is original to HashiCorp Vault. ## Patch This vulnerability is patched in OpenBao v2.7.0 and v2.6.3. ## Workarounds Policy authors using this format of ACL policies would have to add grants for every single possible exclusion format, which may not be feasible depending on endpoint. ## Acknowledgements @HarDToBelieve and @marcIlunga independently disclosed the vulnerability in the policy subsystem. @cipherboy expanded this to cover the remaining cases.