Go/github.com/openbao/openbao CVE-2026-45808: unknown, EPSS 0.43%
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL in github.com/openbao/openbao
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2026-5657
- https://github.com/openbao/openbao/security/advisories/GHSA-v8v8-cm84-m686
- https://github.com/openbao/openbao/commit/c0495646b41cea0e3f5a1030132e9cf5c2375b5c
- https://github.com/openbao/openbao/pull/3152
- https://github.com/openbao/openbao/releases/tag/v2.5.4
CVE-2026-45808 · published · modified · JSON