GHSA-p49j-v9wc-wg57 BIT-openbao-2026-40264 CVE-2026-40264 GO-2026-5526
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
- Severity
- 0.0 / 10
- Low · CVSS 4.0
- Exploit chance (EPSS)
- 0.30%
- Chance of exploitation in the next 30 days. Higher than 22.86% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1259 Improper Restriction of Security Token Assignment
- Fix
0.0.0-20260420162526-f58111d2ca54- Upgrade github.com/openbao/openbao to this version or later
Description
Impact
OpenBao's namespaces provide multi-tenant separation. A tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant.
Patches
This was addressed in v2.5.3.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/openbao/openbao | < 0.0.0-20260420162526-f58111d2ca54 |
0.0.0-20260420162526-f58111d2ca54 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/openbao/openbao Go → 0.0.0-20260420162526-f58111d2ca54
- go
go get github.com/openbao/openbao@v0.0.0-20260420162526-f58111d2ca54 && go mod tidy
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- High
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-1259: Improper Restriction of Security Token Assignment
The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
How to prevent it
- Architecture and Design, Implementation: Security Token assignment review checks for design inconsistency and common weaknesses. Security-Token definition and programming flow is tested in both pre-silicon and post-silicon testing.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-xp3c-3jw3-4vcr OpenBao Skips Stricter Deny Policy for LIST operations | Medium | Also affects github.com/openbao/openbao |
| GHSA-34fc-gh42-pj53 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack | Critical | Also affects github.com/openbao/openbao |
| GHSA-444v-8vxr-p36h OpenBao Agent Writes Secrets to Stdout | Low | Also affects github.com/openbao/openbao |
| GHSA-59w7-v8rr-pr4p OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters | High | Also affects github.com/openbao/openbao |
| GHSA-8w8f-r2xv-4q4j OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types | Medium | Also affects github.com/openbao/openbao |
| GHSA-mwr2-wmgp-crj6 OpenBao's System Backend allows Unauthorized Management of the containing Namespace | Low | Also affects github.com/openbao/openbao |
| GHSA-c36x-h252-g9x2 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 | Low | Also affects github.com/openbao/openbao |
| GHSA-6mwx-4547-5vc9 OpenBao: LDAPi ldaputil (wrong escape func) | Medium | Also affects github.com/openbao/openbao |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor