CVE-2026-45808 openbao CVE debrief

Who should care

OpenBao users and administrators should assess exposure and prioritize remediation to prevent unauthorized lease and credential revocation or renewal. This includes reviewing the official advisory or CVE record to validate affected scope, severity, and vendor guidance. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and apply compensating controls if necessary.

Why it matters

OpenBao users and administrators should assess exposure and prioritize remediation to prevent unauthorized lease and credential revocation or renewal due to a vulnerability in OpenBao's namespaces.

• Potential unauthorized lease and credential revocation or renewal
• Exposure of OpenBao deployments to unintended tenants
• Verification of OpenBao version and compensating controls required

Technical summary

OpenBao's namespaces provide multi-tenant separation, but a tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4. The vulnerability affects OpenBao versions prior to 2.5.4, and users should review the official advisory for affected scope and severity. OpenBao users should assess exposure and prioritize remediation due to potential unauthorized lease and credential revocation or renewal.

Defensive priority

OpenBao users should assess exposure and prioritize remediation due to potential unauthorized lease and credential revocation or renewal.

Recommended defensive actions

• Assess exposure to OpenBao versions prior to 2.5.4
• Prioritize remediation to prevent unauthorized lease and credential revocation or renewal
• Verify inventory of OpenBao deployments and apply compensating controls if necessary
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and OpenBao source references provide details on the vulnerability and fixed version. Evidence is limited, and defenders should verify OpenBao version and compensating controls. The vulnerability affects OpenBao versions prior to 2.5.4, and users should review the official advisory for affected scope and severity. The CVE Program record and NIST NVD detail page provide additional information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.