OpenBao separates tenants through namespaces, but before version 2.5.3 a token’s accessor could be leaked by one tenant and then used by a privileged administrator in a different tenant to either renew or revoke that token. This breach of separation effectively allows an attacker to extend or deny access to secrets that belong to another tenant, exposing the original tenant’s tokens and the secrets they protect. The flaw is classified as CWE‑1259, an information‑exposure weakness through token accessor leakage.

The vulnerability affects all OpenBao deployments of the openbao product running any version earlier than 2.5.3. No additional product or version constraints are listed in the advisory.

The CVSS score of 2.0 reflects a low overall severity, and the EPSS indicator of less than 1% suggests a very low probability of exploitation at this time. The issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to expose a token accessor and then rely on a privileged administrator within another namespace to act upon it; the scope of the impact is confined to the token’s lifetime and the privileges of the admin. Consequently, while the potential for denial of access exists, the practical risk is moderate due to the limited surface area and the need for cross‑namespace administrative privilege.