CVE-2026-45808
NoneCVSS
—
EPSS
0.4%
Published
Aug 7, 2026
CISA due date
—
The record
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | openbao | 0 | 2.5.4-1.1 |
Related vulnerabilities
- CVE-2026-46405 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-46358 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-39396 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-39388 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-40264 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-39946 OpenBao is an open source identity-based secrets management system. Also affects openbao
- CVE-2026-5807 Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker… Also affects openbao
- CVE-2026-3605 An authenticated user with access to a kvv2 path through a policy containing a glob may… Also affects openbao