PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42186 openbao CVE debrief

OpenBao versions prior to 2.5.3 contain a logic flaw in namespace deletion that can leave orphaned data when initial deletion attempts fail. The vulnerability stems from improper cleanup during retry operations, potentially affecting outstanding leases and leaving unrelated storage entries intact after a namespace is marked deleted. This represents a data integrity concern rather than direct confidentiality or availability impact. The CVSS 4.0 vector indicates network attack vector with high attack complexity, requiring prior access and low privileges, with limited integrity impact to both the vulnerable component and subsequent components. The CWE-212 classification (Improper Removal of Sensitive Information Before Storage or Transfer) reflects the incomplete data removal. No known exploitation in the wild has been reported, and the issue is not listed in CISA KEV.

Vendor
openbao
Product
Unknown
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-18
Advisory published
2026-05-14
Advisory updated
2026-05-18

Who should care

OpenBao administrators managing multi-tenant deployments with namespace isolation; security teams responsible for secrets management infrastructure; compliance officers tracking data retention and deletion requirements; operators of shared OpenBao clusters where namespace lifecycle management is critical to tenant isolation guarantees

Technical summary

The vulnerability exists in OpenBao's namespace deletion workflow. When an initial namespace deletion fails—due to transient errors, storage backend issues, or other interruptions—subsequent retry attempts do not properly execute the full data removal sequence. The system incorrectly marks the namespace as deleted while failing to remove associated leases and storage entries. This creates a state where the namespace appears deleted from an API perspective but retains underlying data artifacts. The flaw affects the namespace management subsystem and has potential implications for lease lifecycle management and storage backend consistency. The fix in version 2.5.3 ensures complete cleanup execution during retry operations.

Defensive priority

low

Recommended defensive actions

  • Upgrade OpenBao to version 2.5.3 or later to remediate incomplete namespace deletion cleanup
  • Review namespace deletion audit logs for historical failures that may have left orphaned data
  • Audit storage backends for residual entries from previously deleted namespaces
  • Verify lease cleanup procedures for namespaces deleted prior to patching
  • Monitor for unexpected storage growth or lease anomalies that may indicate incomplete deletion
  • Review access controls to ensure namespace deletion privileges follow least-privilege principles

Evidence notes

Official vulnerability database record confirms affected versions through NVD CPE criteria. Vendor security advisory and patch commit provide technical confirmation of the fix. Release notes verify remediation version.

Official resources

2026-05-14