7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45808

CVE-2026-45808: OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

Impact

OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented sys/revoke and sys/renew endpoints.

Patch

This will be addressed in v2.5.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45808

CVE-2026-45808:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openbao/openbao	go	<= 2.5.3	2.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-45808, is an incorrect authorization flaw in OpenBao that allows for cross-namespace lease manipulation. The root cause lies in the existence of legacy API endpoints for lease management (/sys/revoke, /sys/renew, /sys/revoke-prefix, /sys/revoke-force) that did not correctly enforce namespace-based Access Control Lists (ACLs). This allowed a user with permissions in one namespace to revoke or renew leases belonging to another namespace if they knew the lease ID.

The patch addresses this by removing these legacy endpoints entirely. The changes in vault/logical_system_paths.go are central to the fix. The URL routing patterns were modified to remove the optional (leases/)? prefix, making the leases/ part of the URL path mandatory. For example, the pattern (leases/)?revoke was changed to leases/revoke.

This forces all lease operations to go through the modern, namespace-aware paths (e.g., /sys/leases/revoke), which correctly enforce ACLs. The functions that handle these operations (handleRevoke, handleRenew, etc.) within the SystemBackend were the ones executing the unauthorized actions when called via the vulnerable legacy paths. Therefore, these handler functions, and the leasePaths function that exposed them, are identified as the vulnerable functions.

Vulnerable functions

SystemBackend.leasePaths

vault/logical_system_paths.go

The `leasePaths` function defined the URL patterns for lease operations. The patterns for `renew`, `revoke`, `revoke-force`, and `revoke-prefix` included an optional `(leases/)?` group, which exposed legacy paths like `/sys/revoke` alongside the intended `/sys/leases/revoke`. These legacy paths did not enforce namespace-based ACLs correctly, allowing a user in one namespace to revoke or renew leases in another namespace. The handlers for these paths (`handleRenew`, `handleRevoke`, etc.) were thus processing unauthorized cross-namespace requests.

SystemBackend.handleRenew

vault/logical_system.go

This function handles lease renewals. It was vulnerable because it could be triggered via the legacy `/sys/renew` endpoint, which did not properly enforce namespace boundaries, allowing a user to renew a lease in another namespace.

SystemBackend.handleRevoke

vault/logical_system.go

This function handles lease revocations. It was vulnerable because it could be triggered via the legacy `/sys/revoke` endpoint, which did not properly enforce namespace boundaries, allowing a user to revoke a lease in another namespace.

SystemBackend.handleRevokeForce

vault/logical_system.go

This function handles forced lease revocations. It was vulnerable because it could be triggered via the legacy `/sys/revoke-force` endpoint, which did not properly enforce namespace boundaries, allowing a user to forcefully revoke a lease in another namespace.

SystemBackend.handleRevokePrefix

vault/logical_system.go

This function handles lease revocations by prefix. It was vulnerable because it could be triggered via the legacy `/sys/revoke-prefix` endpoint, which did not properly enforce namespace boundaries, allowing a user to revoke leases with a certain prefix in another namespace.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.