CVE-2026-40264: low-severity vulnerability in openbao
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
OpenBao's token system allowed administrators in one separate tenant area to revoke or renew tokens from another tenant if they knew the token's ID. This bypassed the isolation between different users/organizations that should keep them separate.
A cross-namespace token manipulation vulnerability in OpenBao prior to v2.5.3 permits privileged administrators to revoke or renew tokens across namespace boundaries using exposed token accessors. Exploitation requires knowledge of the target token accessor and administrative privileges in a different namespace; the impact undermines multi-tenant isolation guarantees.
In the same product, most dangerous first.