AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-45808

HIGH · CVSS 7.1 EPSS 0.31% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-07 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

OpenBao's identity-based secrets management system prior to version 2.5.4 is vulnerable due to inadequate multi-tenant separation, allowing a malicious tenant to exploit leaked lease identifiers to revoke or renew credentials belonging to another tenant. This could lead to unauthorized access and compromise of sensitive information. Organizations using OpenBao for secrets management should prioritize upgrading to version 2.5.4 to mitigate this high-severity risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-45808
Severity
HIGH
CVSS
7.1
EPSS
0.31%

Original NVD Description

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.