Skip to content
Advisories.
OpenBaoGHSA-c36x-h252-g9x2

OpenBao: improper authorization

LowCVE-2026-55774 · Published Jun 19, 2026 · updated Sep 25, 2026

### Summary OpenBao users with access to the `sys/leases/revoke/:lease_id` endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations. ### Impact OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked by a user in another tenant. ### Patch This will be fixed in OpenBao v2.5.5. ### References This vulnerability is similar to but distinct from: - CVE-2026-45808 / GHSA-v8v8-cm84-m686 - CVE-2026-40264 / GHSA-p49j-v9wc-wg57

GitHub advisory

Affected versions

PackageAffectedFixed in
github.com/openbao/openbao
Go
>= 0.1.0, <= 2.5.4No fix yet
< 0.0.0-20260617103932-b20b999dd4040.0.0-20260617103932-b20b999dd404
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-863
Also known as
BIT-openbao-2026-55774, CVE-2026-55774, GO-2026-5304

More OpenBao advisories

All OpenBao
Advisory
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
Medium6.5Jun 19
OpenBao's System Backend allows Unauthorized Management of the containing Namespace
LowJun 19
OpenBao: LDAPi ldaputil (wrong escape func)
Medium6.8Jun 19
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
Medium5.3May 28
OpenBao's Inline Auth Incorrectly Redacted Headers
MediumMay 28
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
HighMay 28

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.