GitHub Advisoryadvisory · Go

GHSA-p49j-v9wc-wg57 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

LOW Published 2026-04-21 Modified 2026-04-21 Official page ↗
Aliases
CVE-2026-40264
Ecosystem
Go
Packages
github.com/openbao/openbao
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-1259
Reviewed
2026-04-21

Affected packages

• Go github.com/openbao/openbao: < 0.0.0-20260420162526-f58111d2ca54 → fixed in 0.0.0-20260420162526-f58111d2ca54

Description

Impact OpenBao's namespaces provide multi-tenant separation. A tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. Patches This was addressed in v2.5.3.

Related

Alias · CVE (1)

  • CVE-2026-40264 OpenBao is an open source identity-based secrets management system. vulnerability

Weakness · CWE (1)

  • CWE-1259 Improper Restriction of Security Token Assignment weakness

References