OpenBao Token Store Cross-Namespace Renewal and Revocation Vulnerability

A vulnerability in OpenBao, an open-source identity-based secrets management system, allows for cross-namespace token renewal and revocation. This issue affects versions of OpenBao through 2.5.2. In the multi-tenant environment of OpenBao, a tenant that accidentally exposes token accessors can have their tokens manipulated by a privileged administrator in a different tenant.

Impact

Exploitation of this vulnerability allows a privileged administrator in one tenant to revoke or renew tokens of a tenant in another namespace, potentially disrupting access or functionality that relies on those tokens.

Remediation

Users can upgrade to OpenBao version 2.5.3 or later to address this vulnerability.