CVE-2026-40264
Low · 2.7CVSS
2.7
EPSS
0.4%
Published
Apr 21, 2026
CISA due date
—
The record
OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | openbao | 0 | 2.5.3-1.1 |
Related vulnerabilities
- CVE-2026-45808 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-46405 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-46358 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-39396 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-39388 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-39946 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-5807 Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker… Also affects openbao
- CVE-2026-3605 An authenticated user with access to a kvv2 path through a policy containing a glob may… Also affects openbao