OpenBaoGHSA-p49j-v9wc-wg57

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

CVE-2026-40264 · Published Apr 21, 2026 · updated Sep 10, 2026

Low

Fix: upgrade to 0.0.0-20260420162526-f58111d2ca54 or later

Impact

OpenBao's namespaces provide multi-tenant separation. A tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant.

Patches

This was addressed in v2.5.3.

Affected versions

Package	Affected	Fixed in
github.com/openbao/openbao Go	< 0.0.0-20260420162526-f58111d2ca54	0.0.0-20260420162526-f58111d2ca54

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-1259
Also known as: BIT-openbao-2026-40264, CVE-2026-40264, GO-2026-5526

More OpenBao advisories

All OpenBao

LowMay 5

OpenBao's Namespace Deletion May Not Delete Data ProperlyCVE-2026-42186fixed in 0.0.0-20260420173541-6d2e0506e2b4 Medium 4.9Apr 21

OpenBao's SQL Injection in PostgreSQL database secrets engineCVE-2026-39946fixed in 0.0.0-20260420155735-b596b0882620 Low 3.1Apr 21

OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)CVE-2026-39396fixed in 0.0.0-20260420180337-2b2a901aa9f7 Low 3.1Apr 21

OpenBao's Certificate Authentication Allows Token Renewal With Different CertificateCVE-2026-39388fixed in 0.0.0-20260420160924-abe84e1af4c3 CriticalMar 26

OpenBao has Reflected XSS in its OIDC authentication error messageCVE-2026-33758fixed in 0.0.0-20260325133417-6e2b2dd84f0e Critical 9.6Mar 26

OpenBao lacks user confirmation for OIDC direct callback modeCVE-2026-33757fixed in 0.0.0-20260325142553-e32103951925