CVE-2026-45808 — OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leak…
Published: 2026-08-07 · CVSS: 7.1 · CVSS 4.0
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7