CVE-2026-42186 LOW

CVE-2026-42186: OpenBao's Namespace Deletion May Not Delete Data Properly

Vendor Openbao
Product openbao
Weakness CWE-212
Published May 14, 2026
Last update May 14, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

What the vulnerability does

01Description

OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrelated storage entries around. This vulnerability is fixed in 2.5.3.

Key dates

02Disclosure timeline

May 14, 2026 CVE published
May 14, 2026 Record updated