—

GO-2026-5304

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao

Quick fix

GO-2026-5304 — github.com/openbao/openbao: upgrade to the fixed version with the command below.

go get github.com/openbao/openbao@v0.0.0-20260617103932-b20b999dd404

Details

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/openbao/openbao

Introduced in: 0Fixed in: 0.0.0-20260617103932-b20b999dd404

Fixgo get github.com/openbao/openbao@v0.0.0-20260617103932-b20b999dd404

References

https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2[ADVISORY]
https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37[FIX]
https://github.com/openbao/openbao/pull/3307[FIX]
https://github.com/openbao/openbao/releases/tag/v2.5.5[WEB]