Is CVE-2026-45808 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45808 being exploited in the wild.

How severe is CVE-2026-45808?

High severity, with a CVSS score of 4, published 28 May 2026.

Which products and versions are affected?

github.com/openbao/openbao (Go) <= 2.5.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.5.4; OpenBao <= 2.5.3.

Is there a fix for CVE-2026-45808?

Yes. github.com/openbao/openbao (Go): upgrade to 2.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45808 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45808?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45808: OpenBao authorization bypass in sys/revoke and sys/renew endpoints

Q: Is there a fix for CVE-2026-45808?

Yes. github.com/openbao/openbao (Go): upgrade to 2.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45808 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45808?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45808 · Severity: high · CVSS 4 · Published 2026-05-28

OpenBao is a security tool used to manage secrets and credentials across different isolated environments or 'namespaces'. A vulnerability in its legacy management interface allows a user in one environment to revoke or renew credentials belonging to a different environment if they obtain the relevant identifiers. This could lead to service disruptions or unauthorized credential extensions, undermining the security boundaries between different teams or tenants.

Technologies: github.com/openbao/openbao (Go), OpenBao. Vendors: Go, OpenBao.

Quick answers

Is CVE-2026-45808 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45808 being exploited in the wild.
How severe is CVE-2026-45808?: High severity, with a CVSS score of 4, published 28 May 2026.
Which products and versions are affected?: github.com/openbao/openbao (Go) <= 2.5.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.5.4; OpenBao <= 2.5.3.
Is there a fix for CVE-2026-45808?: Yes. github.com/openbao/openbao (Go): upgrade to 2.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45808 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45808?: Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openbao/openbao (Go): upgrade to 2.5.4 or later
```
go get github.com/openbao/openbao@v2.5.4
```

Technical details

An authorization bypass exists in OpenBao's legacy `sys/revoke` and `sys/renew` endpoints. While OpenBao uses namespaces to provide multi-tenant isolation, these undocumented legacy paths do not correctly enforce Access Control List (ACL) boundaries between namespaces. A remote attacker with low privileges who obtains a lease identifier from another tenant can trigger the revocation or renewal of that lease and its associated credentials. This vulnerability is classified as Incorrect Authorization (CWE-863) and is addressed in OpenBao version 2.5.4.

Affected products

OpenBao OpenBao <= 2.5.3

Identifiers

CVE-2026-45808
GHSA-v8v8-cm84-m686
GO-2026-5657

Timeline

2026-05-21: disclosed
2026-05-28: advisory: GitHub Advisory published
2026-05-28: patched: Version 2.5.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.