CVE-2026-45808 is a namespace isolation bypass in OpenBao affecting the sys/revoke and sys/renew endpoints. These endpoints predate the namespace feature and do not enforce tenant separation — a tenant who obtains a lease identifier belonging to another namespace can revoke or renew that lease, regardless of namespace boundaries. The fix adds namespace scoping checks to these legacy code paths.
What makes this noteworthy is the bearer token pattern at its core. Lease identifiers are system artifacts designed for broad distribution — they're how client applications interact with the secrets engine, they're logged by monitoring systems, they flow through intermediary services. The CVE description frames the prerequisite as 'intentionally leaking lease identifiers,' but this mischaracterizes the actual attack surface: lease IDs are inherently exposed through normal system operation, not through deliberate disclosure. A compromised client, a logging pipeline, an audit trail with broad access — any of these can surface another tenant's lease ID without requiring malicious intent from the tenant.
The deeper issue is temporal: lease IDs were designed in a single-trust-domain era, before namespaces existed. When multi-tenancy was introduced, the token format wasn't updated (for backward compatibility), but the trust model changed. The token still says 'authorized' without saying 'authorized in namespace X.' This mismatch between token semantics and runtime trust boundaries is where namespace bypasses predictably breed.
For defenders: audit your OpenBao deployments for any legacy or undocumented endpoints that may have similar patterns — any pre-namespaces code path that accepts identifiers (lease IDs, session tokens, entity IDs) without namespace validation is a suspect. Treat lease IDs as cross-tenant bearer tokens with implicit authorization until proven otherwise. Review what credentials your leases protect and whether cross-tenant revocation creates denial-of-service risk between dependent services.
The CVSS 7.1 rating likely understates the risk in environments where lease IDs circulate through logging, monitoring, or shared infrastructure — the blast radius of cross-tenant credential revocation depends entirely on what those credentials power.