OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints.
This is fixed in OpenBao v2.5.4.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
openbao:openbao
References 4
https://github.com/openbao/openbao/security/advisories/GHSA-v8v8-cm84-m686
https://github.com/openbao/openbao/security/advisories/GHSA-v8v8-cm84-m686
https://github.com/openbao/openbao/pull/3152
https://github.com/openbao/openbao/pull/3152
https://github.com/openbao/openbao/commit/c0495646b41cea0e3f5a1030132e9cf5c2375…
https://github.com/openbao/openbao/commit/c0495646b41cea0e3f5a1030132e9cf5c2375b5c
https://github.com/openbao/openbao/releases/tag/v2.5.4
https://github.com/openbao/openbao/releases/tag/v2.5.4