https://feed.craftedsignal.io/products/openbao/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 28 May 2026 17:38:26 +0000https://feed.craftedsignal.io/briefs/2026-05-openbao-lease-revoke/Thu, 28 May 2026 17:38:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-openbao-lease-revoke/OpenBao versions up to 2.5.3 allow cross-namespace lease revocation by exploiting legacy sys/revoke endpoints, potentially leading to unauthorized credential access and denial of service.OpenBao, a secrets management solution, utilizes namespaces for multi-tenant isolation. A vulnerability exists in versions 2.5.3 and earlier where a user in one namespace can revoke or renew leases belonging to another namespace. This is achieved by exploiting the legacy, undocumented sys/revoke and sys/renew endpoints. An attacker with knowledge of a valid lease ID from a different namespace can leverage these endpoints to disrupt service or potentially gain unauthorized access to secrets. This vulnerability, identified as CVE-2026-45808, allows bypassing of intended ACL restrictions. The issue is resolved in OpenBao v2.5.4.

Attack Chain

1. Attacker gains access to a valid lease ID from a target namespace, either through unintentional leakage or through malicious insider activity.
2. Attacker crafts an HTTP request targeting the legacy sys/revoke endpoint, including the stolen lease ID in the request body.
3. The OpenBao server processes the request to the sys/revoke endpoint.
4. Due to the legacy nature of the endpoint, ACL checks are bypassed.
5. The targeted lease is revoked, rendering any associated credentials invalid.
6. If the attacker targets the sys/renew endpoint, the lease will be renewed with settings controlled by the attacker.
7. The affected application or service relying on the revoked lease experiences a denial of service or disruption.
8. Depending on the targeted secrets, an attacker might gain unauthorized access to the target application or service if they were able to successfully renew the lease.

Impact

Successful exploitation of CVE-2026-45808 can lead to denial of service for applications relying on OpenBao-managed secrets. In multi-tenant environments, this can impact services in other namespaces, even without proper authorization. While there is no direct information disclosure, unauthorized lease revocation and renewal can interrupt legitimate operations. The severity is high because it impacts availability of critical services.

Recommendation

• Upgrade OpenBao to version 2.5.4 or later to patch CVE-2026-45808.
• Monitor OpenBao logs for requests to the /sys/revoke endpoint, which may indicate unauthorized lease revocation attempts (see Sigma rule below).
• Implement strict lease ID handling procedures within your organization to prevent unintended leakage.
• Consider disabling or restricting access to the sys/revoke and sys/renew endpoints through appropriate ACL policies as a temporary mitigation measure until the upgrade is complete.

]]>highadvisoryvulnerabilityacl-bypasssecrets-managementhttps://feed.craftedsignal.io/briefs/2024-01-openbao-xss/Mon, 29 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-openbao-xss/OpenBao installations with OIDC/JWT authentication enabled and roles with `callback_mode=direct` are vulnerable to reflected XSS via the `error_description` parameter, allowing attackers to steal Web UI tokens; patched in v2.5.2.OpenBao, a secrets management tool, is susceptible to a reflected XSS vulnerability (CVE-2026-33758) affecting installations using OIDC/JWT authentication methods. The vulnerability specifically impacts roles configured with callback_mode=direct. An attacker can exploit this flaw by injecting malicious JavaScript code via the error_description parameter in the authentication error page. Successful exploitation grants the attacker access to the victim's Web UI token, potentially leading to unauthorized access to sensitive secrets. The vulnerability was introduced prior to version 2.5.2 and has been patched in version 2.5.2 by replacing the dynamic error_description with a static error message. Defenders should either upgrade or implement the described workaround immediately.

Attack Chain

1. The attacker identifies an OpenBao instance with OIDC/JWT authentication enabled and at least one role configured with callback_mode=direct.
2. The attacker crafts a malicious URL containing a JavaScript payload within the error_description parameter. Example: /ui/login?error_description=<script>alert('XSS')</script>.
3. The attacker tricks a victim (e.g., an administrator logged into the OpenBao Web UI) into clicking the malicious link, perhaps via phishing or other social engineering methods.
4. The victim's browser sends a request to the OpenBao server with the malicious error_description parameter.
5. The OpenBao server reflects the attacker's JavaScript payload back to the victim's browser within the HTML of the authentication error page.
6. The victim's browser executes the attacker-controlled JavaScript code due to the reflected XSS vulnerability.
7. The malicious JavaScript code steals the victim's authentication token used for accessing the OpenBao Web UI.
8. The attacker uses the stolen token to authenticate to the OpenBao Web UI and gain unauthorized access to secrets.

Impact

Successful exploitation of this XSS vulnerability allows attackers to steal authentication tokens from legitimate OpenBao users. With a stolen token, an attacker can gain complete access to the OpenBao Web UI, allowing them to read, modify, or delete secrets, policies, and other sensitive configurations. This could lead to a complete compromise of the secrets management system, potentially affecting all applications and services that rely on OpenBao for their credentials. The severity is considered critical due to the ease of exploitation and high potential impact on confidentiality and integrity.

Recommendation

• Upgrade OpenBao to version 2.5.2 or later to apply the patch that replaces the vulnerable error_description parameter (reference: Patches section).
• As a workaround, remove any roles configured with callback_mode=direct (reference: Workarounds section).
• Implement a web application firewall (WAF) rule to detect and block requests containing suspicious JavaScript code in the error_description parameter (example rule below).
• Monitor web server logs for requests with error_description containing <script> or other HTML tags commonly used in XSS attacks (reference: example rule below, logsource: webserver).

]]>criticaladvisoryopenbaoxssreflected-xssweb-application