CVE-2026-40264

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40264", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T17:31:45.787Z", "datePublished": "2026-04-21T00:47:38.156Z", "dateUpdated": "2026-04-21T19:30:51.975Z"}, "containers": {"cna": {"title": "OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation", "problemTypes": [{"descriptions": [{"cweId": "CWE-1259", "lang": "en", "description": "CWE-1259: Improper Restriction of Security Token Assignment", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57"}], "affected": [{"vendor": "openbao", "product": "openbao", "versions": [{"version": "< 2.5.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T00:47:38.156Z"}, "descriptions": [{"lang": "en", "value": "OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3."}], "source": {"advisory": "GHSA-p49j-v9wc-wg57", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-21T19:30:42.448978Z", "id": "CVE-2026-40264", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T19:30:51.975Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40264", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T19:30:42.448978Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T19:30:48.614Z"}}], "cna": {"title": "OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation", "source": {"advisory": "GHSA-p49j-v9wc-wg57", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "openbao", "product": "openbao", "versions": [{"status": "affected", "version": "< 2.5.3"}]}], "references": [{"url": "https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57", "name": "https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1259", "description": "CWE-1259: Improper Restriction of Security Token Assignment"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T00:47:38.156Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40264", "state": "PUBLISHED", "dateUpdated": "2026-04-21T19:30:51.975Z", "dateReserved": "2026-04-10T17:31:45.787Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T00:47:38.156Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openbao", "vendor": "openbao", "versions": [{"status": "affected", "version": "< 2.5.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB9CD431-A4A7-47AC-8111-76D4F60A9D07", "versionEndExcluding": "2.5.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3."}, {"lang": "es", "value": "OpenBao es un sistema de gesti\u00f3n de secretos de c\u00f3digo abierto basado en identidad. Los espacios de nombres de OpenBao proporcionan separaci\u00f3n multi-inquilino. Antes de la versi\u00f3n 2.5.3, un inquilino que filtra accesores de token puede ver su token revocado o renovado por un administrador privilegiado en otro inquilino. Esto se aborda en la v2.5.3."}], "id": "CVE-2026-40264", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40264", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-21T19:30:42.448978Z", "version": "2.0.3"}}]}, "published": "2026-04-21T01:16:06.917", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1259"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openbao", "source": "cna", "vendor": "openbao"}, "product": "openbao", "vendor": "openbao"}], "analysis": {"en": {"generated_at": "2026-04-22T03:25:08.247901+00:00", "value": {"mitigation_remediation": ["Upgrade OpenBao to version 2.5.3 or later, where cross\u2011namespace token renewal and revocation are properly isolated.", "Restrict privileged administrator permissions so that administrators cannot act on tokens in namespaces to which they are not granted access.", "Monitor system logs for unexpected token renewal or revocation events across namespaces and investigate anomalies immediately."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011namespace token renewal or revocation by an administrator in another tenant"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all OpenBao deployments of the openbao product running any version earlier than 2.5.3. No additional product or version constraints are listed in the advisory.", "description_and_impact": "OpenBao separates tenants through namespaces, but before version 2.5.3 a token\u2019s accessor could be leaked by one tenant and then used by a privileged administrator in a different tenant to either renew or revoke that token. This breach of separation effectively allows an attacker to extend or deny access to secrets that belong to another tenant, exposing the original tenant\u2019s tokens and the secrets they protect. The flaw is classified as CWE\u20111259, an information\u2011exposure weakness through token accessor leakage.", "risk_and_exploitability": "The CVSS score of 2.0 reflects a low overall severity, and the EPSS indicator of less than 1% suggests a very low probability of exploitation at this time. The issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to expose a token accessor and then rely on a privileged administrator within another namespace to act upon it; the scope of the impact is confined to the token\u2019s lifetime and the privileges of the admin. Consequently, while the potential for denial of access exists, the practical risk is moderate due to the limited surface area and the need for cross\u2011namespace administrative privilege."}}}}, "created": "2026-04-21T02:45:25.753715+00:00", "updated": "2026-04-22T03:30:06.688437+00:00", "vendors": ["openbao", "openbao$PRODUCT$openbao"]}