{"id":"GO-2026-5304","revision":"9a08ea33bdff4f2dbf9b2707e121b557","records":[{"revision":"9a08ea33bdff4f2dbf9b2707e121b557","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5304","aliases":["BIT-openbao-2026-55774","CVE-2026-55774","GHSA-c36x-h252-g9x2"],"title":"OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao","description":"OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao","state":0,"publishedAt":"2026-06-25T18:43:19+00:00","modifiedAt":"2026-09-25T14:25:35.3121592+00:00","affected":[{"ecosystem":"Go","name":"github.com/openbao/openbao","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260617103932-b20b999dd404"},{"kind":"introduced","version":"0.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2","https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37","https://github.com/openbao/openbao/pull/3307","https://github.com/openbao/openbao/releases/tag/v2.5.5"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5304","license":"OSV · upstream source license applies","key":"osv:GO-2026-5304","identifiers":["GO-2026-5304","BIT-openbao-2026-55774","CVE-2026-55774","GHSA-c36x-h252-g9x2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}