OpenBao up to 2.5.2 improper restriction of security token assignment

Summaryinfo

A vulnerability was found in OpenBao up to 2.5.2. It has been rated as problematic. This affects an unknown part. This manipulation causes improper restriction of security token assignment. This vulnerability appears as CVE-2026-40264. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in OpenBao up to 2.5.2 and classified as problematic. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a improper restriction of security token assignment vulnerability. The CWE definition for the vulnerability is CWE-1259. The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected. As an impact it is known to affect availability. The summary by CVE is:

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-40264 since 04/10/2026. The exploitation appears to be easy. The attack can be launched remotely. Additional levels of successful authentication are necessary for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1134.001 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 311376 (Fedora 44 : openbao (2026-c7450bfed6)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.5.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (311376) and CERT Bund (WID-SEC-2026-1189). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source OpenBao

Productinfo

Name

• OpenBao

Version

• 2.5.0
• 2.5.1
• 2.5.2

Website

• Product: https://github.com/openbao/openbao/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion