PkgSeer

Vulnerability GHSA-c36x-h252-g9x2

Low Risk

3 months ago

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

v0.1.0 - v1.15.5

Summary

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

Details

Summary

OpenBao users with access to the sys/leases/revoke/:lease_id endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations.

Impact

OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked by a user in another tenant.

Patch

This will be fixed in OpenBao v2.5.5.

References

This vulnerability is similar to but distinct from:

CVE-2026-45808 / GHSA-v8v8-cm84-m686
CVE-2026-40264 / GHSA-p49j-v9wc-wg57

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

OpenBao Skips Stricter Deny Policy for LIST operations

v0.1.0 - v1.1.5 GHSA-xp3c-3jw3-4vcr

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

v0.1.0 - v1.1.5 GHSA-34fc-gh42-pj53

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

v0.1.0 - v1.1.5 GHSA-59w7-v8rr-pr4p

OpenBao Agent Writes Secrets to Stdout

v0.1.0 - v1.1.5 GHSA-444v-8vxr-p36h

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL in github.com/openbao/openbao

v0.1.0 - v1.15.5 GO-2026-5657

View all vulnerabilities for these packages

Impacted packages

github.com/openbao/openbao

Timeline

Published

3 months ago

Last Modified

2 days ago