OpenBao's System Backend allows Unauthorized Management of the containing Namespace

An attacker who has been granted capabilities on `sys/namespaces/*` within a non-root namespace (the victim namespace) can pass the literal path `"root"` to any `/sys/namespaces/<path>` endpoint. Because `Canonicalize` converts `"root"` to an empty string, the resulting absolute namespace path equals the sys mount's containing namespace — i.e., the victim namespace itself. ACLs are evaluated against the original request path `sys/namespaces/root` before canonicalization, so the attacker's token passes the policy check, and the operation then acts on the victim namespace. This allows the attacker to look up, delete, lock, or patch custom metadata on the victim namespace. [ref_id=2]

The vulnerability resides in the namespace path canonicalization logic in `helper/namespace/namespace.go` (the `Canonicalize` function) and the handler functions in `vault/logical_system_namespaces.go` and `vault/logical_system_namespaces_seals.go`. The `Canonicalize` function treated the literal string `"root"` as equivalent to an empty path, and the handlers called `Canonicalize` before performing ACL checks, allowing the empty path to resolve to the containing namespace. The patch replaces `Canonicalize` with a new `ParseName` function that rejects `"root"` as a valid namespace name, and also adds a guard in `vault/namespace_store.go` to re-route a header of `"root"` to the root namespace.

The patch introduces a new function `ParseName` in `helper/namespace/namespace.go` that calls `Canonicalize` but then rejects an empty result (which would occur when the input is `"root"`), and also rejects reserved names. All handler functions in `logical_system_namespaces.go` and `logical_system_namespaces_seals.go` are changed from calling `namespace.Canonicalize` directly to calling `namespace.ParseName`, so that passing `"root"` as the path segment now returns an error instead of an empty path. Additionally, `vault/namespace_store.go` is updated to re-route a namespace header of `"root/"` to the empty string, ensuring the root namespace is correctly identified. Together these changes close the privilege escalation by ensuring the literal `"root"` can never be used to target the containing namespace. [patch_id=6640290]

Start a development server: `bao server -dev`. Create a namespace: `bao namespace create victim`. Create a policy inside the victim namespace that grants management of namespaces: `bao policy write -namespace=victim namespace-management - <<EOF\npath "sys/namespaces/*" {\n\tcapabilities = ["read", "update", "patch", "delete"]\n}\nEOF`. Create a token with that policy: `export BAO_TOKEN=$(bao token create -namespace=victim -policy=namespace-management -field=token)`. Delete the victim namespace using the token: `bao namespace delete -namespace=victim root`. [ref_id=2]