OpenBao versions prior to 2.6.3 contain an access control list (ACL) bypass vulnerability. This flaw causes explicit deny rules based on forbidden identity metadata templates to be silently dropped when wildcard grants are used. As a result, attackers with identity metadata containing wildcard or path segments can gain unauthorized access to paths that should be denied within the wildcard scope. The issue is fixed in version 2.6.3.