AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

OpenBaoGHSA-v8v8-cm84-m686

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao

CVE-2026-45808 · Published May 28, 2026 · updated Aug 17, 2026

High
Fix: upgrade to 2.5.4 or later
GitHub advisory

Impact

OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented sys/revoke and sys/renew endpoints.

Patch

This will be addressed in v2.5.4.

Affected versions

PackageAffectedFixed in
github.com/openbao/openbao
Go
< 2.5.42.5.4
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-863
Also known as
BIT-openbao-2026-45808, CVE-2026-45808, GO-2026-5657

More OpenBao advisories

All OpenBao
Medium 6.5Jun 19OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesCVE-2026-55776fixed in 0.0.0-20260617104123-db57c62602b2LowJun 19OpenBao's System Backend allows Unauthorized Management of the containing NamespaceCVE-2026-55775fixed in 0.0.0-20260617103935-d3c1cc64b1aeLowJun 19OpenBao: improper authorizationCVE-2026-55774fixed in 0.0.0-20260617103932-b20b999dd404Medium 6.8Jun 19OpenBao: LDAPi ldaputil (wrong escape func)CVE-2026-55770fixed in 0.0.0-20260617104213-10b7825c714cMedium 5.3May 28OpenBao's Kerberos Auth Method Accumulates Unaccessible TokensCVE-2026-46405fixed in 2.5.4MediumMay 28OpenBao's Inline Auth Incorrectly Redacted HeadersCVE-2026-46358fixed in 2.5.4