EUVD-2026-54684
Incorrect Authorization (CWE-863)
GHSA-v8v8-cm84-m686
7.1
CVSS 4.0 · Vendor: vendor:alpine
Share
Severity by source
Vendor (vendor:alpine)
PRIMARY
7.1
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today
AI
5.3
MEDIUM
AC:H because exploitation requires obtaining a cross-namespace lease ID, an explicit prerequisite per the advisory, not a trivial network-reachability condition.
3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X
Lifecycle Timeline
5
Source Code Evidence Fetched
Aug 07, 2026 - 22:29 vuln.today
Analysis Updated
Aug 07, 2026 - 22:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 07, 2026 - 22:22 vuln.today
cvss_changed
CVSS changed
Aug 07, 2026 - 22:22 NVD
7.1 (HIGH)
Analysis Generated
May 27, 2026 - 22:45 vuln.today
DescriptionCVE.org
Alpine Linux: openbao fixed in 2.5.4-r0
AnalysisAI
Cross-namespace lease revocation in OpenBao allows an authenticated user in one namespace to revoke or renew leases belonging to a different namespace via legacy, undocumented API endpoints that bypass ACL enforcement. Affected versions are OpenBao <= 2.5.3 in deployments where the namespace feature is active for multi-tenancy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Access
Authenticate to any OpenBao namespace
Delivery
Obtain victim's cross-namespace lease ID via tenant disclosure or log exposure
Exploit
Send authenticated PUT to legacy /v1/sys/revoke/{lease_id}
Execution
Legacy endpoint bypasses namespace ACL validation
Persist
Victim tenant lease forcibly revoked
Impact
Victim's dynamic credentials invalidated causing service disruption
Access
Authenticate to any OpenBao namespace
Delivery
Obtain victim's cross-namespace lease ID via tenant disclosure or log exposure
Exploit
Send authenticated PUT to legacy /v1/sys/revoke/{lease_id}
Execution
Legacy endpoint bypasses namespace ACL validation
Persist
Victim tenant lease forcibly revoked
Impact
Victim's dynamic credentials invalidated causing service disruption
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the OpenBao cluster must be running version 2.5.3 or earlier with the namespace feature active and multiple distinct tenants present; (2) the attacker must hold valid authentication credentials for any namespace in the cluster - the CVSS vector PR:L confirms low-privilege authenticated access is sufficient; (3) the attacker must possess a lease ID from the victim namespace - the GHSA advisory explicitly states this requires intentional leakage by the victim tenant, such as through shared logs, exposed API responses, or insider disclosure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 7.1 with AV:N/AC:L/PR:L reflects a network-accessible, low-complexity exploit by any authenticated user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user in OpenBao namespace 'tenant-a' obtains a lease ID from namespace 'tenant-b' - for example, through a misconfigured application that logs lease IDs in a shared observability stack, or through deliberate insider disclosure. The attacker sends an authenticated HTTP PUT to /v1/sys/revoke/{leaked_lease_id} on the legacy endpoint, which processes the request without enforcing namespace ACL boundaries. … |
| Remediation | Upgrade OpenBao to version 2.5.4, which is confirmed as the fixed release via the GitHub release tag at https://github.com/openbao/openbao/releases/tag/v2.5.4 and upstream commit c0495646b41cea0e3f5a1030132e9cf5c2375b5c. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all OpenBao deployments with namespace feature active and verify whether systems run version 2.5.3 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).