CVE-2026-55770
Received Received - Intake

LDAP Injection in OpenBao Identity Management System

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55770
EUVD
EUVD-2026-78683

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openbao openbao to 2.5.5 (exc)
openbao openbao 2.6.0
openbao openbao 2.5.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-90 The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55770 is an LDAP injection vulnerability in OpenBao where the wrong escaping function is used for LDAP search filters. The code incorrectly used EscapeLDAPValue, which is designed for Distinguished Names, instead of ldap.EscapeFilter for search filters. This allows attackers to craft usernames with special characters like * or ( to bypass authentication and impersonate other users.

Detection Guidance

To detect this vulnerability, check if your OpenBao instance is running a version prior to 2.5.5. Use the command: openbao version. If the version is 2.5.4 or earlier, the system is vulnerable. Additionally, review LDAP authentication backend configurations for Active Directory UPNDomain paths or UserDN/UserAttr bindings.

Impact Analysis

An attacker could gain unauthorized access to secrets, policies, or modification capabilities by exploiting this vulnerability. They could impersonate administrative accounts, potentially leading to full control over the OpenBao instance. Exploitation requires LDAP authentication backend with Active Directory and attacker-controlled username input.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized modifications to protected health information or personal data, and failure to maintain proper access controls as required by these regulations.

Mitigation Strategies

Immediately upgrade OpenBao to version 2.5.5 or later. If upgrading is not possible, apply the patch from Pull Request #3306 or commit 8077f96bdc02137b0a072146b6f9ca11c96c549c to replace EscapeLDAPValue with ldap.EscapeFilter in LDAP filter construction.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart