# CVE-2026-42186: OpenBao improper data removal during namespace deletion retry

Source: https://junglewise.ai/threats/cve-2026-42186-openbao-improper-data-removal-during-namespace-deletion-retry  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-42186 · Severity: high · CVSS 7.5 · Published 2026-05-14

OpenBao is an open-source system used for managing sensitive identities and secrets. A flaw in how the system handles the deletion of 'namespaces' (isolated environments) can result in sensitive data or active access leases remaining in storage even after the environment is marked as deleted. This could lead to unauthorized data retention or lingering access rights that should have been revoked, potentially impacting security compliance and data isolation.

Technologies: [github.com/openbao/openbao (Go)](https://junglewise.ai/threats/technologies/github-com-openbao-openbao), [OpenBao](https://junglewise.ai/threats/technologies/openbao). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenBao](https://junglewise.ai/threats/vendors/openbao).

## Quick answers

**Is CVE-2026-42186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42186 being exploited in the wild.

**How severe is CVE-2026-42186?** High severity, with a CVSS score of 7.5, published 14 May 2026.

**Which products and versions are affected?** github.com/openbao/openbao (Go) < 0.0.0-20260420173541-6d2e0506e2b4, SEMVER:introduced=0,fixed=0.0.0-20260420173541-6d2e0506e2b4; OpenBao < 2.5.3, <= 2.5.2.

**Is there a fix for CVE-2026-42186?** Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260420173541-6d2e0506e2b4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42186 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42186?** Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openbao/openbao (Go): upgrade to 0.0.0-20260420173541-6d2e0506e2b4 or later

  ```sh
  go get github.com/openbao/openbao@v0.0.0-20260420173541-6d2e0506e2b4
  ```


## Technical details

A vulnerability exists in OpenBao's namespace deletion logic where interrupted deletion processes (tainted namespaces) do not correctly clean up all associated data upon subsequent retry attempts. Specifically, the system may mark a namespace as deleted without successfully revoking all outstanding leases or removing unrelated storage entries. This occurs because mounts must be active for lease revocation to process correctly; if the initial deletion fails partway, subsequent attempts may bypass necessary cleanup steps. Attackers with low privileges could potentially exploit this to leave persistent data in the storage backend. The issue is addressed in version 2.5.3 by ensuring mounts are reloaded during deletion retries to facilitate proper lease revocation.

## Affected products

- OpenBao OpenBao <= 2.5.2

## Identifiers

- CVE-2026-42186
- GHSA-vv66-6rp4-wr4f
- GO-2026-5674

## Timeline

- 2026-04-20: patched: Fix committed and version 2.5.3 released.
- 2026-04-30: disclosed: Security advisory published on GitHub.
- 2026-05-14: advisory: CVE published to NVD.

## References

- [https://github.com/openbao/openbao/commit/6d2e0506e2b41be0eaa6643bf7b4efc9a2c09445](https://github.com/openbao/openbao/commit/6d2e0506e2b41be0eaa6643bf7b4efc9a2c09445)
- [https://github.com/openbao/openbao/releases/tag/v2.5.3](https://github.com/openbao/openbao/releases/tag/v2.5.3)
- [https://github.com/openbao/openbao/security/advisories/GHSA-vv66-6rp4-wr4f](https://github.com/openbao/openbao/security/advisories/GHSA-vv66-6rp4-wr4f)

## Related threats

- [OpenBao policy cache incorrect authorization via namespace traversal](https://junglewise.ai/threats/cve-2026-115365-openbao-from-2-3-0-before-2-6-3-contains-an-incorrect)
- [OpenBao ACL bypass in policy denial evaluation](https://junglewise.ai/threats/cve-2026-115361-openbao-before-2-6-3-contains-an-acl-bypass-vulnerability-that)
- [OpenBao Kubernetes Auth token renewal on revoked credentials](https://junglewise.ai/threats/cve-2026-115356-openbao-before-2-6-4-and-2-7-x-before-2-7-1-does-not-verify-when)
- [OpenBao Agent information disclosure via stdout in exec rendering mode](https://junglewise.ai/threats/cve-2026-77285-openbao-agent-information-disclosure-via-stdout-in-exec-rendering)
- [OpenBao recovery mode timing attack token leakage](https://junglewise.ai/threats/cve-2026-63132-openbao-recovery-mode-timing-attack-token-leakage)