Executive brief
OpenBao is a security tool used to manage sensitive credentials and secrets across different organizational groups (namespaces). A vulnerability exists where a user in one group can prematurely cancel or renew security credentials belonging to a different group if they know the specific credential ID. This could lead to service disruptions or unauthorized access changes if credential identifiers are leaked between tenants.
Technical details
An authorization bypass vulnerability exists in OpenBao's lease management system due to an incomplete fix for a previous issue. Users with access to the 'sys/leases/revoke/:lease_id' or 'sys/leases/renew/:lease_id' endpoints can perform actions on leases outside their own namespace. The root cause is a failure to properly enforce namespace boundaries when processing lease identifiers at these canonical endpoints. An attacker with high privileges in one namespace who obtains a lease ID from another namespace can trigger unauthorized revocation or renewal. This issue is addressed in OpenBao v2.5.5.
Affected products
- OpenBao OpenBao >= 0.1.0, <= 2.5.4
Timeline
- 2026-06-19: advisory: GitHub Advisory GHSA-c36x-h252-g9x2 published
- 2026-06-19: disclosed
- 2026-06-17: patched: Fix committed to repository