CVE-2026-55776 openbao CVE debrief

Who should care

Defenders managing OpenBao instances, especially those with untrusted authenticated users, should assess exposure and apply the patch. This includes operators, security teams, and vulnerability management teams responsible for OpenBao deployments. They should review the vulnerability details, verify exposure, and apply the patch to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-55776 is a medium-severity vulnerability in OpenBao that can lead to denial-of-service. Defenders should verify exposure, especially in deployments with untrusted authenticated users, and apply the patch in version 2.5.5.

• Service disruption due to server process termination
• Potential for denial-of-service attacks
• Need for verification of exposure and patch application
• Possible impact on high-availability deployments

Technical summary

CVE-2026-55776 is a vulnerability in OpenBao's transit/keys/* endpoint. An authenticated caller with write access can cause a server process termination by setting derived to true with rsa-, ecdsa-, or ed25519 key types. This is due to a double-unlock of a mutex in the error path of the Transit policy creation. The issue is fixed in OpenBao version 2.5.5. The vulnerability can lead to denial-of-service attacks, and defenders should prioritize verifying exposure and applying the patch to prevent service disruption in OpenBao instances.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as this vulnerability could lead to service disruption.

Recommended defensive actions

• Verify if OpenBao instances are exposed to untrusted authenticated users with write access to transit/keys/*
• Apply the patch by upgrading to OpenBao version 2.5.5 or later
• Monitor OpenBao logs for unusual termination patterns
• Review access controls for transit/keys/* to limit write access
• Perform a thorough review of the OpenBao configuration and deployment
• Check for any existing mitigations or compensating controls
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify which versions are affected beyond 2.5.5 being fixed. The OpenBao project has released a patch in version 2.5.5. Evidence is limited, and defenders should verify exposure and apply the patch. The vulnerability affects OpenBao instances with untrusted authenticated users having write access to transit/keys/*.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.