CVE-2026-45808 openbao CVE debrief

Who should care

Defenders managing OpenBao instances, especially in multi-tenant environments, should assess exposure and apply the fix. This includes reviewing multi-tenant configurations for potential exposure, verifying if OpenBao versions prior to 2.5.4 are in use, and applying OpenBao v2.5.4 or later. Additionally, defenders should review and restrict access to `sys/revoke` and `sys/renew` endpoints.

Why it matters

CVE-2026-45808 allows unauthorized lease revocation or renewal in OpenBao. Defenders should verify exposure, apply the fix, and review multi-tenant configurations.

• Verify and apply OpenBao v2.5.4 or later to prevent unauthorized lease revocation or renewal
• Assess multi-tenant configurations for potential exposure to undocumented endpoints
• Review and restrict access to `sys/revoke` and `sys/renew` endpoints

Technical summary

OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4. The vulnerability allows unauthorized access to sensitive credentials, potentially leading to data breaches or system compromise. Defenders should assess their exposure and apply the fix to prevent unauthorized lease revocation or renewal.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, especially for multi-tenant environments.

Recommended defensive actions

• Verify if OpenBao versions prior to 2.5.4 are in use
• Apply OpenBao v2.5.4 or later
• Review multi-tenant configurations for potential exposure
• Assess multi-tenant configurations for potential exposure to undocumented endpoints
• Review and restrict access to `sys/revoke` and `sys/renew` endpoints
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source references provide details on the vulnerability and fix. However, additional verification is required to determine the full scope of affected systems and potential impact. Defenders should verify if OpenBao versions prior to 2.5.4 are in use, review multi-tenant configurations for potential exposure, and apply OpenBao v2.5.4 or later. The vulnerability is fixed in OpenBao v2.5.4, and source references provide additional information on the fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.