CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...

CVE-2026-45808

CVE-2026-45808 affects OpenBao before version 2.5.4 , where cross-namespace lease revocation can be triggered by a tenant in another tenant via legacy undocumented endpoints sys/revoke and sys/renew , bypassing namespace ACLs. Root cause: insufficient access control for lease operations across te...

CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

CVE-2026-46405

OpenBao's CVE-2026-46405 affects the Kerberos auth method in OpenBao prior to v2.5.4. The GET handler (and requests with Authorization: Negotiate) can cause the system to return a response that includes a hidden logical.Auth token alongside an error, resulting in tokens created with default polic...

CVE-2026-46358 OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...

CVE-2026-46358

OpenBao CVE-2026-46358 affects the OpenBao identity-based secrets management system. Before v2.5.4, its inline auth feature redacted audit-log entries incorrectly, leaving non-auth headers removed while auth-related headers remained in cleartext. This requires local access to the audit device to ...

CLEANSTART-2026-AU35223 Security fixes in openbao-fips 2.4.4-r8

Package openbao-fips version 2.4.4-r8 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-33814, CVE-2026-33811, CVE-2026-39836...

CLEANSTART-2026-HC31624 Security fixes in openbao-fips 2.4.4-r4

Package openbao-fips version 2.4.4-r4 fixes 4 vulnerabilities: CVE-2026-33186, CVE-2026-25679, CVE-2026-27142, CVE-2020-8911...

CLEANSTART-2026-KW51717 Security fixes in openbao-fips 2.3.2-r4

Package openbao-fips version 2.3.2-r4 fixes 12 vulnerabilities: CVE-2026-26958, CVE-2026-27139, CVE-2026-1229, CVE-2025-54410, CVE-2025-61730...

CLEANSTART-2026-IO24415 Security fixes in openbao-fips 2.5.0-r0

Package openbao-fips version 2.5.0-r0 fixes 1 vulnerabilities: CVE-2025-68121...

CLEANSTART-2026-JG35609 Security fixes in openbao-fips 2.4.4-r5

Package openbao-fips version 2.4.4-r5 fixes 10 vulnerabilities: CVE-2026-34986, CVE-2026-39883, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282...

CLEANSTART-2026-ZD22951 Security fixes in openbao-fips 2.2.2-r9

Package openbao-fips version 2.2.2-r9 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-33814, CVE-2026-33811, CVE-2026-39836...

CLEANSTART-2026-EH14044 Security fixes in openbao-fips 2.5.3-r0

Package openbao-fips version 2.5.3-r0 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-33814, CVE-2026-33811, CVE-2026-39836...

CLEANSTART-2026-RX05059 Security fixes in openbao-fips 2.1.1-r11

Package openbao-fips version 2.1.1-r11 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-33814, CVE-2026-33811, CVE-2026-39836...

CLEANSTART-2026-TO01101 Security fixes in openbao-fips 2.5.2-r0

Package openbao-fips version 2.5.2-r0 fixes 16 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...

CLEANSTART-2026-FG75185 Security fixes in openbao-fips 2.5.1-r1

Package openbao-fips version 2.5.1-r1 fixes 12 vulnerabilities: CVE-2026-34986, CVE-2026-39883, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282...

CLEANSTART-2026-QS11948 Security fixes in openbao-fips 2.5.1-r2

Package openbao-fips version 2.5.1-r2 fixes 12 vulnerabilities: ghsa-9jj7-4m8r-rfcm, CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-27140...

CLEANSTART-2026-HZ82610 Security fixes in openbao-fips 2.2.2-r7

Package openbao-fips version 2.2.2-r7 fixes 10 vulnerabilities: CVE-2026-34986, CVE-2026-39883, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282...

BIT-OPENBAO-2026-42186 OpenBao's Namespace Deletion May Not Delete Data Properly

OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving...

BIT-OPENBAO-2026-40264 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...