https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-42186.htmlhttps://patchthecve.com/cve/CVE-2026-42186.htmlWed, 17 Jun 2026 10:47:28 +0000HIGH 7.5: OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrehttps://patchthecve.com/cve/CVE-2026-40264.htmlhttps://patchthecve.com/cve/CVE-2026-40264.htmlWed, 17 Jun 2026 10:44:55 +0000LOW 2.7: OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.https://patchthecve.com/cve/CVE-2026-39946.htmlhttps://patchthecve.com/cve/CVE-2026-39946.htmlWed, 17 Jun 2026 10:42:48 +0000MEDIUM 4.9: OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation fahttps://patchthecve.com/cve/CVE-2026-39396.htmlhttps://patchthecve.com/cve/CVE-2026-39396.htmlWed, 17 Jun 2026 10:42:02 +0000LOW 3.1: OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes writtehttps://patchthecve.com/cve/CVE-2026-39388.htmlhttps://patchthecve.com/cve/CVE-2026-39388.htmlWed, 17 Jun 2026 10:42:02 +0000LOW 3.1: OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mTLS certificate matches the original. Toke