CVE-2026-45808High▾ TwilightOpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying cred…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented sys/revoke and sys/renew endpoints. This is fixed in OpenBao v2.5.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/openbao/openbao < 2.5.4Patched in:
github.com/openbao/openbao 2.5.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-46358MediumOpenBao is an open source identity-based secrets management system
CVE-2026-46405Medium· 5.3OpenBao is an open source identity-based secrets management system
CVE-2025-54997Critical· 9.1Privileged OpenBao Operator May Execute Code on the Underlying Host
CVE-2026-42186LowOpenBao's Namespace Deletion May Not Delete Data Properly
CVE-2025-54996High· 7.2OpenBao Root Namespace Operator May Elevate Token Privileges
CVE-2025-55003Medium· 5.7OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse