Skip to content
CVE PROGRAM SOURCE RECORD2.0 Low

CVE-2026-40264

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

Description

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openbao openbao

  • < 2.5.3affected

References