CVE-2026-42186CWE-212

OpenBao's Namespace Deletion May Not Delete Data Properly

Low · published May 14, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrelated storage entries around. This vulnerability is fixed in 2.5.3.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer
Published
2026-05-14T14:36Z
EPSS history
Timeline
  • 14 MAY 14:36Z
    OpenBao's Namespace Deletion May Not Delete Data Properly
    cvelistv5