Executive brief
OpenBao, a tool for managing sensitive data like secrets and keys, contains a vulnerability in how it handles administrative namespaces. An authorized user with limited management permissions within a specific namespace can exploit a naming error to gain unauthorized control over that entire namespace. This could allow the user to view, modify, or delete the namespace, potentially leading to data loss or service disruption within that segment of the organization.
Technical details
An improper authorization vulnerability exists in OpenBao's system backend (/sys/namespaces). The vulnerability stems from the special handling of the literal path 'root', which canonicalizes to an empty string. Because ACL evaluation occurs before this canonicalization, a user granted management capabilities on 'sys/namespaces/root' within a non-root namespace can inadvertently operate on the containing namespace itself. An attacker with low privileges (specifically namespace management rights) can perform operations such as lookup, delete, lock, or patching metadata on their parent namespace. This issue is fixed in OpenBao v2.5.5.
Affected products
- OpenBao OpenBao >= 0.1.0, <= 2.5.4
Timeline
- 2026-06-19: advisory: GHSA-mwr2-wmgp-crj6 published
- 2026-06-19: disclosed
- 2026-06-19: patched: Fixed in v2.5.5