Authentication mechanism absence or evasion In github.com/openbao/openbao
Description
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
Impact
OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented sys/revoke and sys/renew endpoints.
Patch
This will be addressed in v2.5.4.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 2.5.4 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.