Cyber Resilience

CVE-2026-42186

Openbao ≤ 2.5.3

Published
14 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v4 2.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0025 16th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-42186 is a low-severity Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212) vulnerability in Openbao Openbao. Its CVSS base score is 2.3 (Low).

Operationally, ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and AU-6 (Audit Record Review, Analysis, and Reporting) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well…

more

as potentially leaving unrelated storage entries around. This vulnerability is fixed in 2.5.3.

CWE(s)
CWE-212

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-40264Same product: Openbao Openbao
CVE-2025-62705Same product: Openbao Openbao
CVE-2025-62513Same product: Openbao Openbao
CVE-2025-55003Same product: Openbao Openbao
CVE-2025-54998Same product: Openbao Openbao
CVE-2026-39946Same product: Openbao Openbao
CVE-2026-33758Same product: Openbao Openbao
CVE-2025-64761Same product: Openbao Openbao
CVE-2026-39388Same product: Openbao Openbao
CVE-2025-54996Same product: Openbao Openbao

Affected Assets

openbao
openbao
≤ 2.5.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
  • AU-6 Audit Record Review, Analysis, and Reporting
Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V14.2.8
  • V14.3.3

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly addresses the flaw by requiring application of the 2.5.3 update that corrects improper data removal during failed namespace deletion retries.

SI-7 Software, Firmware, and Information Integrity partial match
detect

Verifies integrity of storage and ensures no sensitive remnants (leases, entries) remain after namespace deletion operations.

AU-6 Audit Record Review, Analysis, and Reporting partial match
detect

Enables review and analysis of deletion-related audit records to identify failed cleanups and leftover data.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-10 mostly match
prevents

Directly addresses removal of confidential data from process memory and similar in-use contexts before exposure.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.10 Information deletion full match
degrades

Explicit information-deletion control directly addresses improper removal of sensitive data.

A.8.11 Data masking full match
prevents

Data-masking techniques can substitute for removal when full deletion is impractical.

A.8.33 Test information mostly match
prevents

Test-data protection rules require sanitization of production data used in testing.

A.5.12 Classification of information partial match
prevents

Classification identifies sensitive data that must be removed before storage or transfer.

A.5.14 Information transfer partial match
prevents

Information-transfer rules can require sanitization of sensitive content before sharing.

A.5.34 Privacy and protection of PII partial match
prevents

PII-protection requirements include removing identifiers before storage or disclosure.

References