CVE-2026-45808

Name
CVE-2026-45808
Description
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/openbao/openbao/commit/c0495646b41cea0e3f5a1030132e9cf5c2375b5c
security-advisories@github.com https://github.com/openbao/openbao/pull/3152
security-advisories@github.com https://github.com/openbao/openbao/releases/tag/v2.5.4
security-advisories@github.com https://github.com/openbao/openbao/security/advisories/GHSA-v8v8-cm84-m686

Match rules

CPE URI Source package Min version Max version

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openbao edge-community 2.5.4-r0 Kevin Daudt <kdaudt@alpinelinux.org> fixed
openbao 3.24-community 2.5.4-r0 Kevin Daudt <kdaudt@alpinelinux.org> fixed
openbao 3.23-community 2.5.4-r0 Kevin Daudt <kdaudt@alpinelinux.org> fixed