EUVD-2026-24037
GHSA-p49j-v9wc-wg57
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionGitHub Advisory
OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.
AnalysisAI
OpenBao versions prior to 2.5.3 allow high-privileged administrators in one tenant to revoke or renew authentication tokens belonging to users in other tenants if the token accessor is disclosed, bypassing the multi-tenant isolation guarantee. The vulnerability requires high privilege level and user interaction but undermines the core security boundary of OpenBao's namespace-based multi-tenancy model. No active exploitation has been reported.
Technical ContextAI
OpenBao is an identity and secrets management system that enforces multi-tenant isolation through namespace partitioning. Token accessors are identifiers used to reference tokens within the system; they differ from token values themselves but can be used to perform administrative operations like token revocation or renewal. CWE-1259 (Improper Restriction of Rendered UI Layers or Frames) indicates a control flow or authorization bypass issue where one tenant's isolation boundary can be crossed by leveraging leaked metadata (the token accessor) combined with high administrative privileges. The vulnerability exists in the token management logic where accessor-based operations fail to properly validate that the requesting administrator's tenant context matches the token's tenant context before permitting the operation.
RemediationAI
Upgrade OpenBao to version 2.5.3 or later. This is the primary fix and fully resolves the cross-tenant token operation vulnerability. Organizations unable to upgrade immediately should implement compensating controls: (1) Restrict administrative token operations (revocation, renewal) to only same-tenant contexts by implementing custom authorization policies if OpenBao's policy engine supports tenant-aware conditions - this requires careful policy engineering and should be validated with vendor support; (2) Implement strict access controls on high-privilege administrator accounts across tenants, using role-based access control to limit which administrators can perform token operations and in which tenants; (3) Monitor and audit all token revocation and renewal events, particularly cross-tenant operations, to detect abuse. These workarounds are complex and may not fully prevent the vulnerability, so patching is strongly recommended. The vendor advisory at https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57 should be reviewed for additional context.
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when con
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certifi
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. Rated high severity
OpenBao versions before 2.3.0 contain an unauthenticated denial-of-service vulnerability in the root rekey and recovery
OpenBao is an open source identity-based secrets management system. Rated high severity (CVSS 7.5), this vulnerability i
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a den
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certifi
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certifi
Disk exhaustion via decompression bomb in OpenBao's OCI plugin downloader allows network attackers to exhaust victim dis
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certifi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today