CVE-2026-42186: OpenBao improper data removal during namespace deletion retry

CVE-2026-42186 · Severity: high · CVSS 7.5 · Published 2026-05-14

OpenBao is an open-source system used for managing sensitive identities and secrets. A flaw in how the system handles the deletion of 'namespaces' (isolated environments) can result in sensitive data or active access leases remaining in storage even after the environment is marked as deleted. This could lead to unauthorized data retention or lingering access rights that should have been revoked, potentially impacting security compliance and data isolation.

Technologies: github.com/openbao/openbao (Go), OpenBao. Vendors: Go, OpenBao.

Quick answers

Is CVE-2026-42186 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42186 being exploited in the wild.
How severe is CVE-2026-42186?
High severity, with a CVSS score of 7.5, published 14 May 2026.
Which products and versions are affected?
github.com/openbao/openbao (Go) < 0.0.0-20260420173541-6d2e0506e2b4, SEMVER:introduced=0,fixed=0.0.0-20260420173541-6d2e0506e2b4; OpenBao < 2.5.3, <= 2.5.2.
Is there a fix for CVE-2026-42186?
Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260420173541-6d2e0506e2b4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42186 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42186?
Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/openbao/openbao (Go): upgrade to 0.0.0-20260420173541-6d2e0506e2b4 or later
    go get github.com/openbao/openbao@v0.0.0-20260420173541-6d2e0506e2b4

Technical details

A vulnerability exists in OpenBao's namespace deletion logic where interrupted deletion processes (tainted namespaces) do not correctly clean up all associated data upon subsequent retry attempts. Specifically, the system may mark a namespace as deleted without successfully revoking all outstanding leases or removing unrelated storage entries. This occurs because mounts must be active for lease revocation to process correctly; if the initial deletion fails partway, subsequent attempts may bypass necessary cleanup steps. Attackers with low privileges could potentially exploit this to leave persistent data in the storage backend. The issue is addressed in version 2.5.3 by ensuring mounts are reloaded during deletion retries to facilitate proper lease revocation.

Affected products

  • OpenBao OpenBao <= 2.5.2

Identifiers

  • CVE-2026-42186
  • GHSA-vv66-6rp4-wr4f
  • GO-2026-5674

Timeline

  • 2026-04-20: patched: Fix committed and version 2.5.3 released.
  • 2026-04-30: disclosed: Security advisory published on GitHub.
  • 2026-05-14: advisory: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.