https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:00:51.352050+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-10829 bdu:2026-10829 2026-10-03T08:00:51.423937+00:00 bdu:2026-10829 https://cve.radiocsirt.org/vuln/bit-openbao-2026-45808 BIT-openbao-2026-45808 — OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL 2026-10-03T08:00:51.423972+00:00

Affected: Bitnami: openbao

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-kk55331 Withdrawn: CLEANSTART-2026-KK55331 — Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the… 2026-10-03T08:00:51.424009+00:00

Withdrawn by the publisher.

Affected: CleanStart: dex

Multiple security vulnerabilities affect the dex package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-352290 EUVD-2026-352290 2026-10-03T08:00:51.424034+00:00 EUVD-2026-352290 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45808 fkie_cve-2026-45808 2026-10-03T08:00:51.424047+00:00

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.

 https://cve.radiocsirt.org/vuln/ghsa-v8v8-cm84-m686 GHSA-v8v8-cm84-m686 — OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL 2026-10-03T08:00:51.424070+00:00

Affected: Go: github.com/openbao/openbao

# Impact

OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints.

# Patch

This will be addressed in v2.5.4.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10835-1 openSUSE-SU-2026:10835-1 — openbao-2.5.4-1.1 on GA media 2026-10-03T08:00:51.424092+00:00

openbao-2.5.4-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1640 WID-SEC-W-2026-1640 — OpenBao: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-03T08:00:51.424109+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OpenBao ausnutzen, um Sicherheitsvorkehrungen zu umgehen.