OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known, bypassing namespace ACL isolation. The affected lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the request namespace, allowing a tenant that intentionally disclosed a lease identifier to have the lease and its underlying credential revoked by another tenant.
This issue is fixed in version 2.5.5.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 7
https://github.com/openbao/openbao/commit/9ba1413d793223cca67db12434093a2f25fdc…
security-advisories@github.com
https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828b…
security-advisories@github.com
https://github.com/openbao/openbao/pull/3307
security-advisories@github.com
https://github.com/openbao/openbao/pull/3310
security-advisories@github.com
https://github.com/openbao/openbao/releases/tag/v2.5.5
security-advisories@github.com
https://github.com/openbao/openbao/releases/tag/v2.6.0
security-advisories@github.com
https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2
security-advisories@github.com