Vulnerability in Openbao
CVE-2026-55776
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy creation path in builtin/logical/transit/backend.go and sdk/helper/keysutil/policy.go could reach an error path that double-unlocked a mutex while handling this invalid asymmetric derived-key combination, causing a panic, no HTTP response, process exit, and denial of service. JSON and HCL key-creation requests can express the triggering combination. This issue is fixed in version 2.5.5.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.006 (49.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Openbao — versions < 2.5.5
Weakness classification (CWE)
References
- github.com/openbao/openbao/security/advisories/GHSA-8w8f-r2xv-4q4j
- github.com/openbao/openbao/pull/3309
- github.com/openbao/openbao/pull/3312
- github.com/openbao/openbao/commit/bb17827f3e33779a10166f7d0e61b191c0facef9
- github.com/openbao/openbao/commit/db57c62602b25da12951f3f0edb888e7c4da61e5
- github.com/openbao/openbao/releases/tag/v2.5.5
- github.com/openbao/openbao/releases/tag/v2.6.0
Frequently asked questions
- What is CVE-2026-55776?
- CVE-2026-55776 is a medium-severity vulnerability in Openbao, classified under Reachable Assertion. CVSS score: 6.5/10. Published 2026-09-15.
- How severe is CVE-2026-55776?
- Medium severity. CVSS v3 base score is 6.5 out of 10.