CVE-2026-40264: OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
Impact
OpenBao's namespaces provide multi-tenant separation. A tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant.
Patches
This was addressed in v2.5.3.
Other sources
OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40264?
CVE-2026-40264 has been classified with a critical severity rating due to the potential for unauthorized token management.
How do I fix CVE-2026-40264?
To fix CVE-2026-40264, upgrade OpenBao to version 2.5.3 or later where the vulnerability has been addressed.
What are the risks associated with CVE-2026-40264?
The risks of CVE-2026-40264 include unauthorized access to tenant secrets, allowing exploitation via token management operations by malicious users.
Who is affected by CVE-2026-40264?
CVE-2026-40264 affects all users of OpenBao prior to version 2.5.3 that utilize namespaces for multi-tenant separation.
What is OpenBao in relation to CVE-2026-40264?
OpenBao is an open-source identity-based secrets management system impacted by CVE-2026-40264, which allows for critical cross-namespace token operations.