{"action":"Upgrade github.com/openbao/openbao to 0.0.0-20260420162526-f58111d2ca54 or later.","affected":[{"introduced":"0"}],"component":"github.com/openbao/openbao","cve_ids":["CVE-2026-40264"],"ecosystem":"Go","epss":0.00301,"exploited":false,"fixed_versions":["0.0.0-20260420162526-f58111d2ca54"],"ghsa_id":"GHSA-p49j-v9wc-wg57","id":"tcs_01M5KGN09PX47ME6XR1C8EGQ25","modified_at":"2026-07-27T09:11:20.883115102Z","published_at":"2026-06-25T22:34:34Z","references":["https://osv.dev/vulnerability/GO-2026-5526","https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57","https://nvd.nist.gov/vuln/detail/CVE-2026-40264","https://github.com/openbao/openbao/commit/059cc5950303688335d5c8ab9af8e453795d693a","https://github.com/openbao/openbao/pull/2934","https://github.com/openbao/openbao/releases/tag/v2.5.3"],"severity":{"label":"low","score":2.7},"sources":[{"source":"osv","source_id":"GO-2026-5526","url":"https://osv.dev/vulnerability/GO-2026-5526"},{"source":"nvd","source_id":"CVE-2026-40264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40264"}],"summary":"OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation in github.com/openbao/openbao"}