CVE-2026-40264
Fixed in a distro release EPSS <1%CVSS 2.0
OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.
Products: openbao
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/openbao/openbao | 0.0.0-20260420162526-f58111d2ca54 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | openbao | 2.5.3-r0 |
| Chainguard | openbao-compat | 2.5.3-r0 |
| Wolfi | openbao | 2.5.3-r0 |
| Wolfi | openbao-compat | 2.5.3-r0 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE:Tumbleweed | openbao | 2.5.3-1.1 |