Advisoriesby IbisOpenBaoGHSA-c36x-h252-g9x2
OpenBao: improper authorization
Fix: upgrade to 0.0.0-20260617103932-b20b999dd404 or later
Summary
OpenBao users with access to the sys/leases/revoke/:lease_id endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations.
Impact
OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked by a user in another tenant.
Patch
This will be fixed in OpenBao v2.5.5.
References
This vulnerability is similar to but distinct from:
- CVE-2026-45808 / GHSA-v8v8-cm84-m686
- CVE-2026-40264 / GHSA-p49j-v9wc-wg57
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | >= 0.1.0, <= 2.5.4 | No fix yet |
| < 0.0.0-20260617103932-b20b999dd404 | 0.0.0-20260617103932-b20b999dd404 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- BIT-openbao-2026-55774, CVE-2026-55774, GO-2026-5304
More OpenBao advisories
All OpenBao
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesCVE-2026-55776fixed in 0.0.0-20260617104123-db57c62602b2OpenBao's System Backend allows Unauthorized Management of the containing NamespaceCVE-2026-55775fixed in 0.0.0-20260617103935-d3c1cc64b1aeOpenBao: LDAPi ldaputil (wrong escape func)CVE-2026-55770fixed in 0.0.0-20260617104213-10b7825c714cOpenBao's Kerberos Auth Method Accumulates Unaccessible TokensCVE-2026-46405fixed in 2.5.4OpenBao's Inline Auth Incorrectly Redacted HeadersCVE-2026-46358fixed in 2.5.4OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACLCVE-2026-45808fixed in 2.5.4