CVE-2026-40264: OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

Executive brief

### Impact

OpenBao's namespaces provide multi-tenant separation. A tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant.

### Patches

This was addressed in v2.5.3.

Affected products

• Go github.com/openbao/openbao

References

• https://api.github.com/users/Zwique
• https://github.com/Zwique
• https://api.github.com/users/Zwique/gists%7B/gist_id%7D
• https://api.github.com/users/Zwique/repos
• https://avatars.githubusercontent.com/u/97537483?v=4
• https://api.github.com/users/Zwique/events%7B/privacy%7D