CVE-2026-42186: OpenBao's Namespace Deletion May Not Delete Data Properly
Impact
When OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrelated storage entries around.
Patches
This will be patched in OpenBao v2.5.3.
Workarounds
Users may manually remove mounts prior to deleting the namespace.
Audit logs may be used to identify repeated deletion attempts against the same namespace; sys/raw can be used to see what leases were not correctly deleted.
Other sources
OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrelated storage entries around. This vulnerability is fixed in 2.5.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42186?
CVE-2026-42186 has a moderate severity level due to potential data retention issues and lease complications.
How do I fix CVE-2026-42186?
To fix CVE-2026-42186, upgrade to the patched version 0.0.0-20260420173541-6d2e0506e2b4 of OpenBao.
What impact does CVE-2026-42186 have on my system?
CVE-2026-42186 can lead to issues with outstanding leases and the leftover unrelated storage entries upon namespace deletion failures.
Is CVE-2026-42186 present in previous versions of OpenBao?
Yes, CVE-2026-42186 affects versions of OpenBao prior to 0.0.0-20260420173541-6d2e0506e2b4.
How can I identify if my system is vulnerable to CVE-2026-42186?
You can identify vulnerability to CVE-2026-42186 by checking if you are using an affected version of OpenBao before the patch was released.