CVE-2026-55776 Details
Description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy creation path in builtin/logical/transit/backend.go and sdk/helper/keysutil/policy.go could reach an error path that double-unlocked a mutex while handling this invalid asymmetric derived-key combination, causing a panic, no HTTP response, process exit, and denial of service. JSON and HCL key-creation requests can express the triggering combination. This issue is fixed in version 2.5.5.
A denial-of-service vulnerability has been identified in OpenBao, an open-source identity-based secrets management system. This issue affects versions prior to 2.5.5. The vulnerability arises in the Transit secrets engine when an authenticated user with write access to transit keys sets the 'derived' parameter to true while selecting an asymmetric key type (RSA, ECDSA, or Ed25519). This combination triggers a double-unlock of a mutex in the policy management, causing the server to panic, exit the process, and disrupt service. The flaw can be exploited through JSON and HCL key-creation requests that specify the problematic key derivation.
Users can upgrade to OpenBao version 2.5.5 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openbao/openbao/security/advisories/GHSA-8w8f-r2xv-4q4j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/openbao/openbao/commit/bb17827f3e33779a10166f7d0e61b191c0facef9 | [email protected] | Source CodeVendor |
| https://github.com/openbao/openbao/commit/db57c62602b25da12951f3f0edb888e7c4da61e5 | [email protected] | Source CodeVendor |
| https://github.com/openbao/openbao/pull/3309 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/openbao/openbao/pull/3312 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/openbao/openbao/releases/tag/v2.5.5 | [email protected] | Release NotesVendor |
| https://github.com/openbao/openbao/releases/tag/v2.6.0 | [email protected] | Release NotesVendor |
| https://github.com/openbao/openbao/security/advisories/GHSA-8w8f-r2xv-4q4j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenBao | < 2.5.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |