CVE-2026-40264 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
A privileged administrator in one tenant can revoke or renew tokens in another tenant by exploiting cross-namespace token accessor handling.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40264?
CVE-2026-40264 is a low-severity missing authorization vulnerability in openbao, published on 21 Apr 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.
Weakness: CWE-1259
Which versions are affected by CVE-2026-40264?
4 open source packages ship an affected version, including github.com/openbao/openbao and openbao. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openbao/openbao Go | All versions | 0.0.0-20260420162526-f58111d2ca54 |
github.com/openbao/openbao Go | All versions | 0.0.0-20260420162526-f58111d2ca54 |
github.com/openbao/openbao Go | All versions | 0.0.0-20260420162526-f58111d2ca54 |
openbao Bitnami | All versions | 2.5.3 |
Products include Openbao Openbao.
How do I fix CVE-2026-40264?
Upgrade github.com/openbao/openbao to 0.0.0-20260420162526-f58111d2ca54 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-40264 being exploited?
There is no known exploitation of CVE-2026-40264 in the wild and no public exploit code.
Other vulnerabilities in openbao
- CVE-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode
- CVE-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message
- CVE-2025-54997 OpenBao: Privileged Operator May Execute Code on the Underlying Host
- CVE-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation
- CVE-2025-59043 OpenBao vulnerable to denial of service via malicious JSON request processing
Sources
Also known as BIT-openbao-2026-40264, GHSA-p49j-v9wc-wg57, GO-2026-5526.