---
id: CVE-2026-45808
title: OpenBao is an open source identity-based secrets management system
summary: >-
  OpenBao is an open source identity-based secrets management system. Prior to
  version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant
  who intentionally leaks lease identifiers can have their lease and underlying
  cred…
severity: high
cwe:
  - CWE-863
vendor: openbao
product: github.com/openbao/openbao
affected:
  - github.com/openbao/openbao < 2.5.4
patched:
  - github.com/openbao/openbao 2.5.4
published: '2026-08-07'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45808'
references:
  - url: >-
      https://github.com/openbao/openbao/commit/c0495646b41cea0e3f5a1030132e9cf5c2375b5c
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3152'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.5.4'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-v8v8-cm84-m686'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao'
tags:
  - nvd
  - osv
  - go
epss: 0.00308
epssPercentile: 0.23862
aliases:
  - GHSA-v8v8-cm84-m686
  - BIT-openbao-2026-45808
  - GO-2026-5657
ecosystem: go
ingestedAt: '2026-08-17T19:20:56.043Z'
---

## Overview

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-45808)

Affected packages:

- `github.com/openbao/openbao < 2.5.4`

Patched in:

- `github.com/openbao/openbao 2.5.4`

Source: https://osv.dev/vulnerability/GHSA-v8v8-cm84-m686