CVE-2026-40264CWE-1259

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

Low · published April 21, 2026

CVSS v4.0
2.0
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00365 · 29.1th percentile
Weakness
CWE-1259 · Improper Restriction of Security Token Assignment
Published
2026-04-21T00:47Z
EPSS history
Timeline
  • 21 APR 00:47Z
    OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
    cvelistv5