CVE-2026-42186
HighSummary
OpenBao is an identity-based secrets management system. Prior to version 2.5.3, when the initial namespace deletion fails, subsequent retries do not properly remove all data before marking the namespace as deleted.
Risk Assessment
This vulnerability can affect outstanding leases and potentially leave unrelated storage entries, which may lead to unauthorized access to data.
Recommendation
It is recommended to upgrade to version 2.5.3 to eliminate this vulnerability and ensure proper data management.
Other vulnerabilities in OpenBao
See all- CVE-2026-33757Critical
OpenBao prior to version 2.5.2 does not prompt for user confirmation when logging in via JWT/OIDC with a role set to `callback_mode=direct`. This allows an attacker to perform remote phishing by having the victim visit a URL and automatically log into the attacker's session.
- CVE-2026-46405Medium
OpenBao before version 2.5.4 has a vulnerability in the Kerberos auth method where the response to a GET request or with an Authorization: Negotiate header includes a logical.Auth object in addition to an error message. This results in tokens being created with default policy, default TTL, and no entity information, hidden by the error message. These tokens are not accessible to the caller or outside sys/raw.
- CVE-2026-45808High
OpenBao prior to version 2.5.4 has a vulnerability in namespaces where a tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented sys/revoke and sys/renew endpoints.
- CVE-2026-46358Medium
OpenBao before version 2.5.4 has a vulnerability in the inline auth functionality that incorrectly redacts audit log entries, removing non-auth headers and retaining auth-related headers in cleartext. This requires an attacker to compromise access to the audit device.
- CVE-2026-33758Medium
OpenBao versions prior to 2.5.2 with OIDC/JWT authentication enabled and a role configured with `callback_mode=direct` are vulnerable to XSS via the `error_description` parameter on the failed authentication page. An attacker can steal the token used in the Web UI by a victim.
Original NVD description (English source)
OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrelated storage entries around. This vulnerability is fixed in 2.5.3.