CyberRota Analysis
AI-GeneratedOpenBao versions prior to 2.5.5 are vulnerable to a namespace ACL isolation bypass, allowing users with knowledge of a lease ID to revoke leases across different namespaces. This could lead to unauthorized access and credential revocation, potentially impacting the confidentiality and availability of sensitive information. Organizations utilizing OpenBao for secrets management should prioritize upgrading to version 2.5.5 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known, bypassing namespace ACL isolation. The affected lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the request namespace, allowing a tenant that intentionally disclosed a lease identifier to have the lease and its underlying credential revoked by another tenant. This issue is fixed in version 2.5.5.