{"id":"CVE-2026-45808","title":"OpenBao is an open source identity-based secrets management system","summary":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying cred…","severity":"high","cwe":["CWE-863"],"vendor":"openbao","product":"github.com/openbao/openbao","affected":["github.com/openbao/openbao < 2.5.4"],"patched":["github.com/openbao/openbao 2.5.4"],"published":"2026-08-07","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:02:22.660","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45808","references":[{"url":"https://github.com/openbao/openbao/commit/c0495646b41cea0e3f5a1030132e9cf5c2375b5c","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/pull/3152","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/releases/tag/v2.5.4","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-v8v8-cm84-m686","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao"}],"tags":["nvd","osv","go"],"epss":0.00308,"epssPercentile":0.23795,"aliases":["GHSA-v8v8-cm84-m686","BIT-openbao-2026-45808","GO-2026-5657"],"ecosystem":"go","ingestedAt":"2026-08-17T19:20:56.043Z","slug":"CVE-2026-45808","body":"## Overview\n\nOpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-45808)\n\nAffected packages:\n\n- `github.com/openbao/openbao < 2.5.4`\n\nPatched in:\n\n- `github.com/openbao/openbao 2.5.4`\n\nSource: https://osv.dev/vulnerability/GHSA-v8v8-cm84-m686","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}