OpenBao versions prior to 2.5.4 expose undocumented sys/revoke and sys/renew endpoints that allow a tenant to intentionally leak lease identifiers and, through those endpoints, revoke or renew leases belonging to other namespaces. The revocation bypasses ACL checks, enabling an attacker to remove valid credentials or force renewal of leases, effectively creating a cross‑tenant privilege escalation opportunity identified as CWE‑863.

The affected product is OpenBao openbao, specifically any installation before version 2.5.4. The vulnerability exists in the legacy namespace system that provides multi‑tenant separation for secret leases.

The vulnerability carries a CVSS score of 7.1, indicating a high severity. EPSS information is not available, so the exploitation probability is unknown but the presence of an undocumented API endpoint suggests a plausible remote exploitation path for authenticated users who can causally leak or discover lease identifiers. The vulnerability is not listed in the CISA KEV catalog. The risk is moderate to high for exposed installations with permissive ACLs, as an attacker could disrupt or gain unauthorized access to credentials owned by other tenants.