—

GO-2026-5304

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao

Details

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/openbao/openbao

Introduced in: 0 Fixed in: 0.0.0-20260617103932-b20b999dd404

Fix go get github.com/openbao/openbao@v0.0.0-20260617103932-b20b999dd404

References

https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2 [ADVISORY]
https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37 [FIX]
https://github.com/openbao/openbao/pull/3307 [FIX]
https://github.com/openbao/openbao/releases/tag/v2.5.5 [WEB]