OpenBao allows users to create namespaces that hold secrets. Prior to version 2.5.3, when an attempt to delete a namespace fails, subsequent retries do not fully remove all data before the namespace is marked as deleted. The result is that leftover leases and unrelated storage entries persist, which can lead to data exposure or loss of data integrity. The CVSS score of 2.3 indicates a low severity, but the persistence of data after a namespace is supposedly removed can still pose a risk in high‑confidentiality environments.

Vulnerable OpenBao installations are those running any version earlier than 2.5.3. The vendor OpenBao is affected.

The vulnerability requires the attacker to have the ability to initiate or retry a namespace deletion, which typically demands local or privileged access to the OpenBao instance. Although the EPSS score is not available and the issue is not listed in CISA KEV, the potential for residual data to remain after removal can be exploited in environments where secrets are highly sensitive. The ease of exploitation is low to medium, subject to the existence of valid deletion requests and sufficient permissions. The impact is mainly data persistence and possible inadvertent leakage rather than immediate remote code execution or denial of service.