Skip to main content

OpenBao EUVDEUVD-2026-54684

| CVE-2026-45808 HIGH
Incorrect Authorization (CWE-863)
N/A vendor:alpine GHSA-v8v8-cm84-m686
Authentication Bypass
7.1
CVSS 4.0 · Vendor: vendor:alpine
Share

Severity by source

Vendor (vendor:alpine) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

AC:H because exploitation requires obtaining a cross-namespace lease ID, an explicit prerequisite per the advisory, not a trivial network-reachability condition.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vendor:alpine).

CVSS VectorVendor: vendor:alpine

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
Aug 07, 2026 - 22:29 vuln.today
Analysis Updated
Aug 07, 2026 - 22:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 07, 2026 - 22:22 vuln.today
cvss_changed
CVSS changed
Aug 07, 2026 - 22:22 NVD
7.1 (HIGH)
Analysis Generated
May 27, 2026 - 22:45 vuln.today

DescriptionCVE.org

Alpine Linux: openbao fixed in 2.5.4-r0

AnalysisAI

Cross-namespace lease revocation in OpenBao allows an authenticated user in one namespace to revoke or renew leases belonging to a different namespace via legacy, undocumented API endpoints that bypass ACL enforcement. Affected versions are OpenBao <= 2.5.3 in deployments where the namespace feature is active for multi-tenancy. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to any OpenBao namespace
Delivery
Obtain victim's cross-namespace lease ID via tenant disclosure or log exposure
Exploit
Send authenticated PUT to legacy /v1/sys/revoke/{lease_id}
Execution
Legacy endpoint bypasses namespace ACL validation
Persist
Victim tenant lease forcibly revoked
Impact
Victim's dynamic credentials invalidated causing service disruption
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) the OpenBao cluster must be running version 2.5.3 or earlier with the namespace feature active and multiple distinct tenants present; (2) the attacker must hold valid authentication credentials for any namespace in the cluster - the CVSS vector PR:L confirms low-privilege authenticated access is sufficient; (3) the attacker must possess a lease ID from the victim namespace - the GHSA advisory explicitly states this requires intentional leakage by the victim tenant, such as through shared logs, exposed API responses, or insider disclosure. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 score of 7.1 with AV:N/AC:L/PR:L reflects a network-accessible, low-complexity exploit by any authenticated user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated user in OpenBao namespace 'tenant-a' obtains a lease ID from namespace 'tenant-b' - for example, through a misconfigured application that logs lease IDs in a shared observability stack, or through deliberate insider disclosure. The attacker sends an authenticated HTTP PUT to /v1/sys/revoke/{leaked_lease_id} on the legacy endpoint, which processes the request without enforcing namespace ACL boundaries. …
Remediation Upgrade OpenBao to version 2.5.4, which is confirmed as the fixed release via the GitHub release tag at https://github.com/openbao/openbao/releases/tag/v2.5.4 and upstream commit c0495646b41cea0e3f5a1030132e9cf5c2375b5c. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all OpenBao deployments with namespace feature active and verify whether systems run version 2.5.3 or earlier. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8
CVE-2024-38856 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-54684 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy