How severe is CVE-2026-40264?

CVE-2026-40264 has a CVSS 3.x base score of 2.7, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-40264 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-40264?

CVE-2026-40264 affects Openbao. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-40264?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-40264 have an EU (EUVD) identifier?

Yes. CVE-2026-40264 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-24037.

When was CVE-2026-40264 published?

CVE-2026-40264 was published on 2026-04-21 and last updated on 2026-06-17.

CVE-2026-40264

CVE-2026-40264 is a low-severity vulnerability in Openbao with a CVSS 3.x base score of 2.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1259.

Key facts

Severity: Low (CVSS 3.x base score 2.7)
CVSS v4: 2.0
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-24037
Weakness: CWE-1259
Affected product: Openbao
Published: 2026-04-21
Last modified: 2026-06-17

Description

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.

Frequently asked questions

What is CVE-2026-40264?: OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.
How severe is CVE-2026-40264?: CVE-2026-40264 has a CVSS 3.x base score of 2.7, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-40264 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-40264?: CVE-2026-40264 affects Openbao. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-40264?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-40264 have an EU (EUVD) identifier?: Yes. CVE-2026-40264 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-24037.
When was CVE-2026-40264 published?: CVE-2026-40264 was published on 2026-04-21 and last updated on 2026-06-17.

References

https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57

Affected products (1)

cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*

More vulnerabilities in Openbao

CVE-2026-33757 — Critical (CVSS 9.6): OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for…
CVE-2025-54997 — Critical (CVSS 9.1): OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets,…
CVE-2024-2048 — High (CVSS 8.1): Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates…
CVE-2026-42186 — High (CVSS 7.5): OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace…
CVE-2025-62513 — High (CVSS 7.5): OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log…
CVE-2025-59043 — High (CVSS 7.5): OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects…

All CVEs affecting Openbao →

Other CWE-1259 vulnerabilities

CVE-2024-36533 — Critical (CVSS 9.8): Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining…
CVE-2024-29371 — High (CVSS 7.5): In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web…
CVE-2026-25700 — High (CVSS 7.2): Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer:…
CVE-2025-56207 — Medium (CVSS 6.5): A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an…
CVE-2024-4598 — Medium (CVSS 6.5): An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich…
CVE-2025-51306 — Medium (CVSS 6.5): In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the…

Browse all CWE-1259 vulnerabilities →