CVE-2026-55774
Received Received - Intake

OpenBao Namespace ACL Bypass via Lease Revocation

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known, bypassing namespace ACL isolation. The affected lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the request namespace, allowing a tenant that intentionally disclosed a lease identifier to have the lease and its underlying credential revoked by another tenant. This issue is fixed in version 2.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55774
EUVD
EUVD-2026-78681

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openbao openbao to 2.5.5 (exc)
openbao openbao 2.5.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenBao allows a user with access to sys/leases/revoke/:lease_id in one namespace to revoke leases in another namespace by providing a known lease ID. This bypasses namespace ACL isolation, enabling a tenant to revoke leases and underlying credentials belonging to another tenant if the lease ID is disclosed.

Detection Guidance

To detect this vulnerability, check OpenBao versions prior to 2.5.5. Use commands like 'openbao version' or inspect deployment manifests to verify the installed version. Monitor logs for unauthorized sys/leases/revoke/:lease_id access attempts across namespaces.

Impact Analysis

The impact includes unauthorized lease revocation across namespaces, leading to potential service disruption for affected tenants. Attackers could exploit this to revoke critical credentials, causing downtime or loss of access to essential resources.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized access and revocation of credentials, potentially violating data protection requirements such as GDPR's integrity principle or HIPAA's access controls. Organizations must ensure proper namespace isolation to maintain compliance.

Mitigation Strategies

Upgrade OpenBao to version 2.5.5 or later immediately. Review namespace ACLs to ensure proper isolation. Audit sys/leases/revoke/:lease_id access logs for suspicious activity. Restrict access to lease revocation endpoints to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart