OpenBao CVE-2026-55774

OpenBao is an open-source secrets management platform (a fork of HashiCorp Vault) written in Go. It uses a namespace model to provide multi-tenant isolation: each tenant operates within a discrete namespace, and ACL policies are scoped per namespace. Lease identifiers in OpenBao embed a namespace ID as a suffix (extracted via namespace.SplitIDFromString). The root cause (CWE-863: Incorrect Authorization) is that the request handling code in vault/request_handling.go was overriding the request's namespace context with the namespace embedded inside the lease ID itself, before ACL evaluation. This meant that when a tenant in namespace A presented a lease ID belonging to namespace B via the canonical path sys/leases/revoke/:lease_id, the system switched the execution context to namespace B and processed the revocation, skipping ACL enforcement that should have prevented cross-namespace operations. A parallel bug existed in vault/expiration.go's loadEntry function, which also extracted namespace context from the embedded lease ID during storage lookups, compounding the bypass. The fix in PR #3307 removes this automatic namespace-context override logic and adds explicit namespace validation in FetchLeaseTimesByToken.