CVE-2026-40264
Low
Description
OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.
SeverityLow
CVSS2.7
Exploit probability—
ProductOpenbao
PublishedApr 21, 2026
First seenApr 21, 2026
Weakness typeCWE-1259CWE-1259
How to fix
Update
- openbao openbao2.5.3 or later
- github.com/openbao/openbao0.0.0-20260420162526-f58111d2ca54 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openbao openbao | v < 2.5.3 | 2.5.3 |
| github.com/openbao/openbaoGo | v < 0.0.0-20260420162526-f58111d2ca54 | 0.0.0-20260420162526-f58111d2ca54 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.