PT-2026-42807 · Openbao · Openbao

Published 2026-05-21 · Updated 2026-05-29 · CVE-2026-45808

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.4

Description Namespaces in OpenBao are designed to provide multi-tenant separation. However, a tenant that leaks lease identifiers may allow a user from another tenant to revoke or renew their lease and underlying credentials. This occurs through the legacy, undocumented endpoints "sys/revoke" and "sys/renew".

Recommendations Update to version 2.5.4.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-45808

GHSA-V8V8-CM84-M686

OPENSUSE-SU-2026:10835-1

Affected Products

Openbao

References · 15

• https://osv.dev/vulnerability/GHSA-v8v8-cm84-m686 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10835-1 · Vendor Advisory
• https://github.com/openbao/openbao/pull/3152 · Note
• https://github.com/openbao/openbao/commit/c0495646b41cea0e3f5a1030132e9cf5c2375b5c · Note
• https://github.com/openbao/openbao/security/advisories/GHSA-v8v8-cm84-m686 · Note
• https://github.com/openbao/openbao/releases/tag/v2.5.4 · Note
• https://github.com/openbao/openbao · Note
• https://reddit.com/r/VulnMatter/comments/1tr3s9r/resumen_diario_de_vulnerabilidades_29052026 · Reddit Post
• https://twitter.com/dailycve/status/2060132287941955843 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1tr0f8l/resumen_diario_de_vulnerabilidades_29052026 · Reddit Post
• https://suse.com/security/cve/CVE-2026-46405 · Note
• https://reddit.com/r/VulnMatter/comments/1tqerun/resumen_diario_de_vulnerabilidades_28052026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1tqmcvv/resumen_diario_de_vulnerabilidades_29052026 · Reddit Post
• https://suse.com/security/cve/CVE-2026-46358 · Note
• https://suse.com/security/cve/CVE-2026-45808 · Note