OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bf7889aec6 advisory.

    Update to upstream-2.5.4, including fixes for CVE-2026-46358, CVE-2026-46405, and CVE-2026-45808

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d4e8f0a731 advisory.

    Update to upstream-2.5.4, including fixes for CVE-2026-46358, CVE-2026-46405, and CVE-2026-45808

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  CVE-2026-45808


There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does
    not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to
    `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by
    having the victim visit the URL and automatically log-in to the session of the attacker. Despite being
    based on the authorization code flow, the `direct` mode calls back directly to the API and allows an
    attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional
    confirmation screen for `direct` type logins that requires manual user interaction in order to finish the
    authentication. This issue can be worked around either by removing any roles with `callback_mode=direct`
    or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.
    (CVE-2026-33757)

  - An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete
    secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did
    not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault
    Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16. (CVE-2026-3605)

  - Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly
    initiate or cancel root token generation or rekey operations, occupying the single in-progress operation
    slot. This prevents legitimate operators from completing these workflows. This vulnerability,
    CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0. (CVE-2026-5807)

  - OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao
    installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct`
    configured are vulnerable to XSS via the `error_description` parameter on the page for a failed
    authentication. This allows an attacker access to the token used in the Web UI by a victim. The
    `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability
    can be mitigated by removing any roles with `callback_mode` set to `direct`. (CVE-2026-33758)

ID	Name	Product	Family	Severity
317525	Fedora 44 : openbao (2026-bf7889aec6)	Nessus	Fedora Local Security Checks	high
317524	Fedora 43 : openbao (2026-d4e8f0a731)	Nessus	Fedora Local Security Checks	high
442443	SCA: security update for github.com/openbao/openbao (GHSA-v8v8-cm84-m686)	Tenable Cloud Security	SCA Checks	high
442443	SCA: security update for github.com/openbao/openbao (GHSA-v8v8-cm84-m686)	Tenable Self-Hosted Container Security	SCA Checks	high
442269	Alpine: multiple openbao packages: security update to 2.5.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
442269	Alpine: multiple openbao packages: security update to 2.5.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical

Detections

Analytics

CVE-2026-45808

high

Tenable Plugins

high

high

high

high

critical

critical