Vulnerability GO-2026-5304
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 06:43 PM UTC
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao
<0.0.0-20260617103932-b20b999dd404
<0.0.0-20260617103932-b20b999dd404
Summary
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao
Details
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
5 days ago
OpenBao Skips Stricter Deny Policy for LIST operations
v0.1.0 - v1.1.5 GHSA-xp3c-3jw3-4vcr
v0.1.0 - v1.1.5 GHSA-xp3c-3jw3-4vcr
Critical
5 days ago
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
v0.1.0 - v1.1.5 GHSA-34fc-gh42-pj53
v0.1.0 - v1.1.5 GHSA-34fc-gh42-pj53
High Risk
5 days ago
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
v0.1.0 - v1.1.5 GHSA-59w7-v8rr-pr4p
v0.1.0 - v1.1.5 GHSA-59w7-v8rr-pr4p
Low Risk
5 days ago
OpenBao Agent Writes Secrets to Stdout
v0.1.0 - v1.1.5 GHSA-444v-8vxr-p36h
v0.1.0 - v1.1.5 GHSA-444v-8vxr-p36h
Unknown
3 months ago
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL in github.com/openbao/openbao
v0.1.0 - v1.15.5 GO-2026-5657
v0.1.0 - v1.15.5 GO-2026-5657
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 06:43 PM UTC
Last Modified
2 days ago
September 25, 2026 at 02:25 PM UTC