BIT-openbao-2026-42186

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2026-42186.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-openbao-2026-42186

Aliases

Published

2026-07-27T05:49:11Z

Modified

2026-09-10T16:01:44Z

Summary

OpenBao's Namespace Deletion May Not Delete Data Properly

Details

OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrelated storage entries around. This vulnerability is fixed in 2.5.3.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:openbao:openbao:*:*:*:*:*:go:*:*"
    ],
    "severity":  "High"
}

References

Affected packages

Bitnami / openbao

Package

Name: openbao
Purl: pkg:bitnami/openbao

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.5.3

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2026-42186.json"