OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

HOCH 7.1CVE-2026-45808 · BIT-openbao-2026-45808 · GHSA-v8v8-cm84-m686 · Published 07/08/2026 · updated 09/09/2026

Kurz gesagt

CVE-2026-45808 ist eine Schwachstelle (HOCH (CVSS 7.1)) in github.com/openbao/openbao.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.43%, höher als bei 37.0% aller Schwachstellen.
Abhilfe: auf 2.5.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/openbao/openbao Go	`< 2.5.4all versions`	`2.5.4`

Description

Impact

OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented sys/revoke and sys/renew endpoints.

Patch

This will be addressed in v2.5.4.

NVD description

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.