GO-2026-5304

vendorUSosv

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao

view advisory published 2026-06-25Licence: per source

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-55774US	—OT elevated	0.56% (47th)	—	2026-09-15
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease…

references

External citations — patches, advisories, analysis.

https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37FIX
https://github.com/openbao/openbao/pull/3307FIX
https://github.com/openbao/openbao/releases/tag/v2.5.5WEB
https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan