PT-2026-37251 · Go+1 · Github.Com/Openbao/Openbao+1

Cipherboy · Published 2026-05-05 · Updated 2026-05-14 · CVE-2026-42186

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.3

Description An issue exists in the identity-based secrets management system where an initial failure during namespace deletion causes subsequent retries to fail to remove all data before the namespace is marked as deleted. This may result in outstanding leases remaining active or unrelated storage entries being left behind.

Recommendations Update to version 2.5.3. Manually remove mounts prior to deleting the namespace. Use audit logs to identify repeated deletion attempts against the same namespace and utilize sys/raw to identify leases that were not correctly deleted.

Fix

Weakness Enumeration

CWE-212

Related Identifiers

CVE-2026-42186

GHSA-VV66-6RP4-WR4F

Affected Products

Github.Com/Openbao/Openbao

Openbao

References · 6

• https://github.com/openbao/openbao/security/advisories/GHSA-vv66-6rp4-wr4f · Vendor Advisory
• https://github.com/openbao/openbao/commit/6d2e0506e2b41be0eaa6643bf7b4efc9a2c09445 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42186 · Security Note
• https://osv.dev/vulnerability/GHSA-vv66-6rp4-wr4f · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://github.com/openbao/openbao/releases/tag/v2.5.3 · Note