Kurz gesagt
- CVE-2026-55774 ist eine Schwachstelle (NIEDRIG (CVSS 2.1)) in github.com/openbao/openbao.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.56%, höher als bei 46.7% aller Schwachstellen.
- Abhilfe: auf 0.0.0-20260617103932-b20b999dd404 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| github.com/openbao/openbao Go | ≥ 0.1.0, ≤ 2.5.4≥ 0.1.0< 0.0.0-20260617103932-b20b999dd404
| 0.0.0-20260617103932-b20b999dd404
|
Description
Summary
OpenBao users with access to the sys/leases/revoke/:lease_id endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations.
Impact
OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked by a user in another tenant.
Patch
This will be fixed in OpenBao v2.5.5.
References
This vulnerability is similar to but distinct from:
- CVE-2026-45808 / GHSA-v8v8-cm84-m686
- CVE-2026-40264 / GHSA-p49j-v9wc-wg57
NVD description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known, bypassing namespace ACL isolation. The affected lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the request namespace, allowing a tenant that intentionally disclosed a lease identifier to have the lease and its underlying credential revoked by another tenant. This issue is fixed in version 2.5.5.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free